CVE-2026-41840 is a vulnerability in the Spring Framework affecting WebFlux applications that process multipart requests. The issue is a missing release of memory after its effective lifetime (CWE-401), which can be exploited to cause a denial of service (DoS) by exhausting system resources. The vulnerability impacts Spring Framework versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. No official remediation or patch information is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to denial of service conditions by causing the application to consume excessive memory resources without releasing them, potentially resulting in application crashes or degraded service availability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting exposure of affected endpoints and monitoring application resource usage to detect abnormal memory consumption patterns. Avoid processing untrusted multipart requests if possible.