CVE-2026-41853 is a vulnerability in the Spring Framework affecting MVC and WebFlux applications that allows HTTP request smuggling through multipart requests. This occurs due to inconsistent parsing of HTTP requests, enabling an attacker to interfere with the processing of subsequent requests. The affected versions include Spring Framework 5.3.0 to 5.3.48, 6.1.0 to 6.1.27, 6.2.0 to 6.2.18, and 7.0.0 to 7.0.7. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a medium impact primarily on integrity without confidentiality or availability impact. No official remediation or patch has been documented in the provided data.

The vulnerability allows an attacker to perform HTTP request smuggling via multipart requests, potentially leading to manipulation of request handling and impacting the integrity of the application. There is no direct confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor Spring Framework advisories for updates. Avoid deploying affected versions in high-risk environments until a patch is available.