Denial of Service Vulnerability in Spring Framework Products by Spring
CVE-2026-41840

5.9MEDIUM

Key Information:

Vendor

Spring

Status
Spring Framework
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41840?

Spring Framework applications leveraging WebFlux are susceptible to Denial of Service (DoS) attacks through the mishandling of multipart requests. This vulnerability allows attackers to exploit specific conditions to disrupt service availability, leading to potential downtime or degradation of application performance. It is crucial for users running affected versions to apply security patches and updates to mitigate the risk.

Affected Version(s)

Spring Framework 7.0.0 < 7.0.8

Spring Framework 6.2.0 < 6.2.19

Spring Framework 6.1.0 < 6.1.28

References

https://spring.io/security/cve-2026-41840

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.