CVE-2026-47885: CWE-770 Allocation of Resources Without Limits or Throttling in Spring Spring Framework

The vulnerability identified as CVE-2026-47885 involves the PartEventHttpMessageReader component in Spring WebFlux failing to enforce the maximum part size limit when the maxInMemorySize configuration is set to -1. This results in uncontrolled resource allocation, categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). The affected versions include Spring Framework 7.0.0 to 7.0.8, 6.2.0 to 6.2.19, and 6.1.0 to 6.1.28. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to bypass the maxPartSize limit in Spring WebFlux when maxInMemorySize is set to -1, potentially leading to uncontrolled resource allocation. This can impact the integrity of the application by allowing malicious input to be processed without proper size restrictions. There is no direct confidentiality or availability impact reported. The flaw could be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid setting maxInMemorySize to -1 or apply any recommended configuration changes from the vendor. Monitor official Spring Framework advisories for updates.