Description

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T06:17:18.747Z",
  "pubdate": "2026-08-27T06:17:18.747Z",
  "executiveSummary": "This vulnerability involves an improper enforcement of resource limitations within the PartEventHttpMessageReader component of the Spring Framework. Specifically, the framework fails to correctly apply the configured maxPartSize limit when the maxInMemorySize parameter is explicitly set to -1.\nThe vulnerability allows for a potential Denial of Service (DoS) attack, as an attacker can submit multipart requests containing excessively large parts that bypass size restrictions. By sending requests that exceed intended memory or storage constraints, a remote attacker can cause the application to consume excessive system resources, leading to service degradation or application crashes.\nAffected products include Spring Framework 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, and 6.1.0 through 6.1.28. The risk is significant in environments where multipart file uploads or large payload processing is exposed to untrusted users. Exploitation does not require authentication, as the vulnerability manifests during the initial parsing of HTTP multipart requests, providing an unauthenticated attacker the ability to impact system availability.\nOrganizations using the affected versions of Spring WebFlux should prioritize updating to a patched version to ensure that maxPartSize constraints are consistently enforced regardless of the maxInMemorySize configuration.",
  "technicalDetails": "The vulnerability resides in the PartEventHttpMessageReader class, which is responsible for parsing multipart HTTP requests in a reactive, non-blocking manner using Spring WebFlux. The logic intended to restrict the size of individual parts is bypassed due to a configuration dependency issue involving the maxInMemorySize attribute.\nWhen a developer configures the reader to set maxInMemorySize to -1, it is intended to signal the framework to buffer parts exclusively on disk or to change the memory management strategy. However, the implementation of PartEventHttpMessageReader fails to validate the input stream against the maxPartSize limit when this specific memory threshold configuration is active. Consequently, the component does not verify the total size of the incoming multipart element against the defined bounds.\nThe attack flow begins when an attacker crafts a malicious multipart/form-data request. The attacker sends a request body containing a single, massive part that intentionally ignores the intended server-side limits. Because the validation logic is incorrectly conditional on the memory buffer settings, the reader continues to stream the request content into the file system or internal buffers without triggering the exception handler responsible for enforcing maxPartSize.\nThis failure leads to uncontrolled resource consumption. As the server continues to write the oversized part to disk or memory, it consumes disk I/O and storage space, or potentially exhausts temporary file storage partitions. In high-concurrency environments, multiple such requests can lead to rapid storage exhaustion, causing the host system or the JVM to experience critical performance degradation or a complete application crash.\nAffected versions include Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, and 6.1.0-6.1.28. The vulnerability is network-exposed, as it is reachable via standard HTTP endpoints that handle multipart requests. Since the parsing logic precedes standard application-level authentication filters in many request processing pipelines, the attack vector is available even without valid session credentials. The post-exploitation impact is primarily the loss of availability, potentially causing downtime for legitimate traffic processed by the affected WebFlux instance."
}