Threats Tagged 'ghsa-q49m-fm49-9mmx'

CVE-2026-47885 is a high-severity vulnerability in the Spring Framework's WebFlux module affecting versions 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. The issue arises because the PartEventHttpMessageReader does not enforce the maxPartSize limit when maxInMemorySize is set to -1, leading to allocation of resources without limits or throttling. This flaw could potentially allow resource exhaustion attacks. No official patch or remediation guidance has been confirmed yet.