CVE-2026-47885
Received Received - Intake

PartEventHttpMessageReader Max Part Size Bypass in Spring Framework

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-47885
EUVD
EUVD-2026-66853

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
spring framework to 7.0.8 (inc)
spring framework to 6.2.19 (inc)
spring framework to 6.1.28 (inc)
spring_project spring_framework From 7.0.0 (inc) to 7.0.8 (inc)
spring_project spring_framework From 6.2.0 (inc) to 6.2.19 (inc)
spring_project spring_framework From 6.1.0 (inc) to 6.1.28 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The PartEventHttpMessageReader in Spring WebFlux fails to enforce the maxPartSize limit when maxInMemorySize is set to -1. This affects applications using controller methods with an @RequestBody Flux<PartEvent> argument.

Detection Guidance

This vulnerability can be detected by checking the Spring Framework version in use. If your application uses Spring WebFlux with versions 7.0.0-7.0.8, 6.2.0-6.2.19, or 6.1.0-6.1.28, it is vulnerable. No specific commands are provided for detection beyond version checks.

Impact Analysis

This vulnerability could allow attackers to bypass size restrictions on file uploads or multipart requests, potentially leading to denial of service or unauthorized data processing.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if exploited to process excessive file uploads, leading to unauthorized data exposure or denial of service. However, the provided context does not explicitly link this issue to specific compliance violations.

Mitigation Strategies

Upgrade to fixed versions: Spring Framework 7.0.9, 7.0.8.1 (Enterprise), 6.2.20 (Enterprise), or 6.1.29 (Enterprise). No additional mitigation steps are required beyond upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47885. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart