CVE-2026-22740

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.

Older, unsupported versions are also affected.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.0.7"
                },
                {
                    "introduced": "6.2.0"
                },
                {
                    "fixed": "6.2.18"
                },
                {
                    "introduced": "6.1.0"
                },
                {
                    "fixed": "6.1.27"
                },
                {
                    "introduced": "5.3.0"
                },
                {
                    "fixed": "5.3.48"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-400"
    ],
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22740.json"
}

References

Affected packages

Git / github.com/spring-projects/spring-framework

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-framework

Events

Introduced

5024bb72279188f1d0dcfe19e8abdd4bdb9887c8

Fixed

6b117247d383294662e199c6b47d7bf54c49caaa

Introduced

fe00848be255db1455f0189d9ff28661f301be36

Fixed

c997d4018d3dc6a7dde2e20eae3627599a01e169

Database specific

{
    "extracted_events": [
        {
            "introduced": "6.2.0"
        },
        {
            "fixed": "6.2.18"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.7"
        }
    ],
    "source": "CPE_FIELD",
    "cpe": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22740.json"