CVE-2026-47885

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28

Description The PartEventHttpMessageReader in Spring WebFlux fails to enforce the maxPartSize limit when the maxInMemorySize variable is configured to -1.

Recommendations Update Spring Framework versions 7.0.0 through 7.0.8 to a newer version. Update Spring Framework versions 6.2.0 through 6.2.19 to a newer version. Update Spring Framework versions 6.1.0 through 6.1.28 to a newer version. Avoid setting the maxInMemorySize variable to -1 to ensure the maxPartSize limit is enforced.