CVE-2026-41840 Overview
CVE-2026-41840 is a Denial of Service (DoS) vulnerability affecting Spring Framework's WebFlux module. Spring WebFlux applications fail to safely handle malformed or resource-intensive multipart requests, allowing remote attackers to exhaust server resources. The flaw is categorized under [CWE-400] (Uncontrolled Resource Consumption) and impacts multiple supported Spring Framework release lines. No authentication or user interaction is required to trigger the condition, although exploitation requires specific request conditions to be met.
Critical Impact
Unauthenticated remote attackers can degrade or disrupt the availability of Spring WebFlux applications by sending crafted multipart requests that exhaust server resources.
Affected Products
- Spring Framework 7.0.0 through 7.0.7
- Spring Framework 6.2.0 through 6.2.18 and 6.1.0 through 6.1.27
- Spring Framework 5.3.0 through 5.3.48
Discovery Timeline
- 2026-06-09 - CVE-2026-41840 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-41840
Vulnerability Analysis
The vulnerability resides in Spring WebFlux's multipart request processing pipeline. Spring WebFlux is the reactive web framework provided by the Spring ecosystem for building non-blocking, asynchronous web applications. When the framework parses multipart Content-Type requests, the processing logic fails to enforce sufficient bounds on resource consumption.
An attacker can craft multipart payloads that force the application to consume disproportionate CPU, memory, or thread resources during parsing. The condition aligns with the [CWE-400] classification for Uncontrolled Resource Consumption. Sustained exploitation degrades responsiveness for legitimate users and can render the service unavailable.
Root Cause
The root cause is improper resource management in the multipart parsing logic across affected Spring Framework versions. The reactive multipart decoder does not adequately constrain processing work performed for adversarial inputs. This allows a single request, or a small volume of requests, to consume server capacity beyond what application operators expect.
Attack Vector
Exploitation occurs over the network against any endpoint that accepts multipart form data in a Spring WebFlux application. Attackers send specially crafted multipart requests to the target service. No credentials or user interaction are required. Successful exploitation results in degraded availability or complete denial of service for the WebFlux application.
No verified public proof-of-concept is available at this time. Refer to the Spring Security Advisory CVE-2026-41840 for technical details published by the vendor.
Detection Methods for CVE-2026-41840
Indicators of Compromise
- Unexplained spikes in CPU, memory, or thread pool utilization on Spring WebFlux application instances.
- High volumes of inbound HTTP requests with Content-Type: multipart/form-data from a narrow set of source addresses.
- Application logs showing slow or stalled multipart processing, dropped reactive streams, or OutOfMemoryError events.
- Increased upstream latency and HTTP 5xx responses correlated with multipart traffic patterns.
Detection Strategies
- Inspect WebFlux access logs for abnormally large multipart payloads or repeated multipart requests with unusual boundary structures.
- Correlate JVM metrics (heap usage, GC pauses, thread counts) with HTTP request patterns to identify resource-driven outages.
- Deploy WAF or reverse proxy rules to flag malformed multipart payloads and anomalous part counts.
Monitoring Recommendations
- Enable structured logging for the Spring Framework multipart pipeline and forward logs to a centralized analytics platform.
- Configure alerting on sustained CPU saturation, GC overhead, and thread pool exhaustion in WebFlux services.
- Track request rate, payload size distribution, and source IP entropy for multipart endpoints.
How to Mitigate CVE-2026-41840
Immediate Actions Required
- Inventory all applications using Spring Framework and identify those running affected WebFlux versions.
- Upgrade to a patched Spring Framework release as documented in the vendor advisory.
- Restrict exposure of multipart endpoints to trusted clients where feasible, using network controls or authentication.
- Apply rate limiting and request size limits at the ingress layer for endpoints accepting multipart data.
Patch Information
VMware/Spring has released fixed versions addressing this issue. Consult the Spring Security Advisory CVE-2026-41840 for the specific patched versions corresponding to the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines. Upgrade affected applications and rebuild dependent artifacts.
Workarounds
- Enforce strict multipart size limits and part count limits at the reverse proxy or API gateway.
- Reject requests with unexpected Content-Type headers or malformed multipart boundaries before they reach the application.
- Disable multipart processing on endpoints that do not require file uploads.
- Deploy a Web Application Firewall (WAF) policy to filter suspicious multipart traffic patterns.
# Configuration example: constrain multipart processing in a Spring Boot WebFlux application
# (application.properties)
spring.webflux.multipart.max-in-memory-size=64KB
spring.webflux.multipart.max-disk-usage-per-part=1MB
spring.webflux.multipart.max-parts=20
spring.webflux.multipart.max-headers-size=8KB
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
