CVE-2026-22740

Published: Apr 29, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: security@vmware.com (Secondary)

Description

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

Affected (4)

Products: Vmware: Spring Framework

Vmware

1 product

Spring Framework

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Framework	Before 5.3.48
Vmware Spring Framework	From 6.1.0 to 6.1.27
Vmware Spring Framework	From 6.2.0 to 6.2.18
Vmware Spring Framework	From 7.0.0 to 7.0.7

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (2)

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1

Source: security@vmware.com

US Government Resource

https://spring.io/security/cve-2026-22740

Source: security@vmware.com

Vendor Advisory

Timeline

No history available yet.