CVE-2026-22740: WebFlux Server DoS Vulnerability

CVE-2026-22740 Overview

A resource exhaustion vulnerability exists in Spring WebFlux server applications that process multipart requests. The framework creates temporary files for multipart parts larger than 10 KB, and under certain circumstances, these temporary files may not be properly deleted after the request is fully processed. This allows an attacker to repeatedly send multipart requests to consume available disk space, potentially causing a denial of service condition.

Critical Impact

Authenticated attackers can exhaust disk space on vulnerable Spring WebFlux servers by sending specially crafted multipart requests, leading to denial of service and potential system instability.

Affected Products

• Spring WebFlux applications processing multipart requests
• Applications using Spring Framework with WebFlux reactive web support
• Older, unsupported versions of Spring Framework

Discovery Timeline

• 2026-04-29 - CVE CVE-2026-22740 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-22740

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The flaw resides in how Spring WebFlux handles multipart request processing. When a WebFlux server receives multipart requests containing parts larger than 10 KB, the framework automatically creates temporary files on disk to store these parts during processing.

The core issue is that under specific circumstances—likely related to request handling edge cases, error conditions, or premature connection termination—the cleanup mechanism fails to remove these temporary files after the request lifecycle completes. Over time, or through deliberate exploitation, this leads to accumulated disk space consumption.

Root Cause

The root cause lies in improper resource management within the multipart request handling pipeline. Temporary file cleanup is not guaranteed under all execution paths, particularly in scenarios involving:

• Abnormal request termination or client disconnection
• Exception handling during multipart parsing
• Race conditions in asynchronous reactive processing
• Incomplete request body consumption

The cleanup routine responsible for removing temporary files may be bypassed or fail silently, leaving orphaned files in the system's temporary directory.

Attack Vector

The attack can be executed over the network by any authenticated user with the ability to submit multipart requests to the vulnerable application. An attacker would craft requests with multipart parts exceeding the 10 KB threshold, potentially including:

• Multiple large file uploads in a single request
• Repeated submission of multipart forms with large payloads
• Deliberately malformed requests designed to trigger cleanup failures

By automating these requests, an attacker can systematically fill the target server's disk space, eventually causing application failures, logging issues, or complete system unavailability.

The vulnerability does not require special privileges beyond basic authentication, and no user interaction is needed beyond the attacker's own actions. The impact is limited to availability—there is no confidentiality or integrity breach.

Detection Methods for CVE-2026-22740

Indicators of Compromise

• Unusual growth in disk space consumption in temporary directories (typically /tmp on Linux or system temp folder on Windows)
• Accumulation of temporary files with naming patterns consistent with Spring multipart handling
• High volume of multipart POST requests from single sources or IP ranges
• Application errors related to disk space exhaustion or file creation failures

Detection Strategies

• Monitor disk space utilization on servers running Spring WebFlux applications with alerting thresholds
• Implement log analysis for repeated multipart request patterns from individual clients
• Configure file system monitoring to track temporary file creation and deletion rates
• Review application logs for warnings related to multipart processing failures
• Deploy rate limiting on endpoints accepting multipart requests

Monitoring Recommendations

• Set up automated alerts when temporary directory usage exceeds defined thresholds
• Implement request rate monitoring for endpoints processing file uploads or multipart forms
• Configure periodic cleanup jobs to remove stale temporary files as a defensive measure
• Enable detailed logging for multipart request handling to identify cleanup failures

How to Mitigate CVE-2026-22740

Immediate Actions Required

• Review the Spring Security Advisory CVE-2026-22740 for official guidance and patch information
• Identify all applications using Spring WebFlux with multipart request processing
• Monitor disk space usage on affected servers and implement emergency cleanup procedures if needed
• Consider implementing request rate limiting on multipart endpoints as an interim control

Patch Information

Spring has published a security advisory addressing this vulnerability. Administrators should consult the Spring Security Advisory CVE-2026-22740 for specific patch versions and upgrade instructions.

Apply the latest security patches from Spring Framework as soon as they become available. Given that older, unsupported versions are also affected, organizations running legacy Spring versions should prioritize upgrading to a supported release.

Workarounds

• Implement custom temporary file cleanup routines that periodically purge orphaned multipart files
• Configure lower size limits for multipart parts to reduce disk space impact
• Deploy request rate limiting to prevent automated exploitation attempts
• Set up disk space quotas for temporary directories used by the application
• Consider using in-memory multipart handling for smaller payloads where feasible

# Example: Scheduled cleanup of stale temporary files older than 1 hour
# Add to crontab or systemd timer
find /tmp -name "spring-multipart-*" -type f -mmin +60 -delete

# Monitor temporary directory disk usage
df -h /tmp | awk 'NR==2 {print "Temp disk usage: " $5}'