CVE-2026-41853 describes a vulnerability in Spring MVC and WebFlux applications where multipart HTTP requests can be smuggled due to inconsistent interpretation of HTTP requests (CWE-444). This can lead to request smuggling attacks that may impact the integrity of the application. The affected versions include Spring Framework 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The vulnerability has a CVSS 3.1 base score of 5.3 with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability. There is no vendor advisory or patch information currently available.

The vulnerability allows an attacker to perform HTTP request smuggling via multipart requests, potentially leading to integrity violations in affected Spring Framework applications. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor official Spring Framework advisories for updates and consider applying any recommended mitigations once available.