This vulnerability (CVE-2026-41840) in Spring Framework's WebFlux module allows an attacker to cause a Denial of Service by sending specially crafted multipart requests that trigger uncontrolled resource consumption. The affected versions span multiple major releases from 5.3.0 up to 7.0.7. The CVSS 3.1 base score is 5.9, indicating medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability. No official fix or patch has been documented in the provided data, and the vendor has not indicated a remediation level. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption).

Successful exploitation results in denial of service by exhausting resources when processing multipart requests in vulnerable Spring WebFlux applications. There is no impact on confidentiality or integrity reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting or filtering multipart request sizes and rates at the application or network level to mitigate potential resource exhaustion. Monitor vendor channels for updates.