CVE-2026-47885 in Spring
Summary
by MITRE • 08/27/2026
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in the PartEventHttpMessageReader component of Spring WebFlux represents a critical configuration-based flaw that undermines memory protection mechanisms within the framework. This issue specifically affects versions ranging from Spring Framework 7.0.0 through 7.0.8, as well as the 6.2.x and 6.1.x series up to their respective latest patch releases. The core of the problem lies in how the multipart form data parser handles size constraints when certain configuration parameters are adjusted for performance or flexibility reasons. In typical web application scenarios involving file uploads or complex form submissions, developers often configure limits to prevent resource exhaustion attacks such as Denial of Service (DoS). However, this specific implementation detail reveals a gap where one limit effectively bypasses another due to conditional logic errors in the message reader class.
The technical root cause stems from the interaction between two distinct configuration properties: maxPartSize and maxInMemorySize. The maxPartSize parameter is designed to restrict the size of individual parts within a multipart request, ensuring that no single component exceeds a defined threshold regardless of whether it resides in memory or on disk. Conversely, maxInMemorySize determines the threshold at which uploaded data is flushed from RAM to temporary storage on the file system. When an administrator sets maxInMemorySize to -1, they are instructing the framework to keep all multipart content entirely in memory indefinitely, presumably for performance optimization where latency reduction outweighs memory conservation concerns. The flaw occurs because the PartEventHttpMessageReader fails to apply the maxPartSize enforcement logic when this specific negative value is detected for the in-memory threshold. Consequently, the parser proceeds without validating the size of individual parts against the configured limit, allowing arbitrarily large data chunks to be processed and held in heap memory.
This behavior creates a severe operational impact centered on resource exhaustion and potential remote code execution vectors through out-of-memory conditions. An attacker can exploit this by submitting multipart requests containing extremely large part payloads that exceed the intended maxPartSize limits but are accepted because the system is configured to keep everything in memory. As these oversized parts accumulate, they consume increasing amounts of JVM heap space without triggering any rejection or throttling mechanisms. This leads directly to Java Virtual Machine (JVM) crashes due to OutOfMemoryError exceptions, resulting in a complete denial of service for all users accessing the application. Furthermore, if garbage collection is unable to reclaim memory fast enough, it can cause significant latency spikes across the entire server cluster, degrading performance even before an outright crash occurs. In environments where such configurations are used for high-throughput APIs, this vulnerability effectively neutralizes one of the primary defenses against volumetric attacks targeting application-level resources rather than network bandwidth.
From a classification perspective, this flaw aligns with CWE-400: Uncontrolled Resource Consumption and CWE-787: Out-of-bounds Write if the memory corruption leads to heap overflow scenarios in underlying native libraries or specific JVM implementations. It also maps closely to MITRE ATT&CK technique T1496: Resource Hijacking, where an adversary consumes computational resources to disrupt service availability. The vulnerability is particularly insidious because it requires a deliberate configuration choice by the developer rather than being exploitable through default settings alone. This means that organizations using standard configurations may remain unaffected, while those optimizing for performance via in-memory processing are at high risk. Security teams must audit their Spring WebFlux deployments to identify any instances where maxInMemorySize is explicitly set to -1 or similar unbounded values without compensating controls such as external rate limiting or WAF rules that inspect payload sizes before they reach the application layer.
Mitigation strategies should prioritize reverting the configuration to a positive integer value for maxInMemorySize, thereby re-enabling the disk-flush mechanism which inherently respects part size limits. If keeping data in memory is strictly necessary for performance requirements, developers must implement custom validation logic or use alternative multipart parsing libraries that enforce strict boundary checks regardless of storage location settings. Additionally, upgrading to a patched version of Spring Framework where this conditional logic has been corrected is the most robust long-term solution. For immediate remediation without code changes, deploying reverse proxies such as Nginx or Apache with limits on client body size can act as an external guardrail, preventing oversized requests from ever reaching the vulnerable application component. Regular security assessments and static analysis tools should be configured to flag configurations that disable memory safeguards in favor of performance metrics, ensuring that operational efficiency does not come at the cost of system stability and availability.