The vulnerability CVE-2026-22740 in VMware Spring Framework arises from improper cleanup of temporary files created during multipart request processing in WebFlux server applications. Specifically, temp files for parts exceeding 10 KB may remain undeleted after the request is fully processed, enabling an attacker to consume disk space and cause a denial of service condition. Affected versions include 5.3.0, 6.1.0, 6.2.0, and 7.0.0. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. No vendor advisory or patch information is currently available.

An attacker can exploit this vulnerability to cause uncontrolled resource consumption by filling disk space with undeleted temporary files, potentially leading to denial of service due to lack of available disk space. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider monitoring disk usage closely on affected systems and implementing application-level controls to limit multipart request sizes or clean up temp files manually if possible.