CVE-2026-41840: Spring Framework Denial of Service via Multipart Requests in WebFlux

June 9, 2026 (updated July 30, 2026)

Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

References

github.com/advisories/GHSA-83f7-v6px-pp3h
github.com/spring-projects/spring-framework/releases/tag/v6.2.19
github.com/spring-projects/spring-framework/releases/tag/v7.0.8
nvd.nist.gov/vuln/detail/CVE-2026-41840
spring.io/security/cve-2026-41840

Code Behaviors & Features

Detect and mitigate CVE-2026-41840 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →