A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 29, 2026 · NIST NVD

   Detected

   A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

2. Jun 17, 2026 · NIST NVD

   Updated

   A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

Affected

• cpe vmware/spring frameworkversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-22740

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-22740

  A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsuppo

  nvd.nist.gov

References

• US Government Resource · nvd.nist.gov
• Vendor Advisory · spring.io