PT-2026-35899 · Webflux · Webflux

Xint Code + 1 · Published 2026-04-29 · Updated 2026-05-15 · CVE-2026-22740

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions WebFlux server application (affected versions not specified)

Description A WebFlux server application that processes multipart requests creates temporary files for parts larger than 10 K. Under certain conditions, these temporary files may not be deleted after the request is fully processed, which allows an attacker to consume available disk space.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-22740

GHSA-5843-P793-GHMM

Affected Products

Webflux

References · 13

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1 · Security Note
• https://spring.io/security/cve-2026-22740 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22740 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22740 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22740 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5843-p793-ghmm · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22740 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-22740 · Security Note
• https://github.com/spring-projects/spring-framework · Note
• https://twitter.com/f1tym1/status/2055314631187451978 · Twitter Post
• https://twitter.com/CVEnew/status/2049594370240753740 · Twitter Post
• https://t.me/cveNotify/162030 · Telegram Post