cve-2026-22740

{
  "cvss": 6.5,
  "datePublished": "2026-04-29T12:16:18.333",
  "dateUpdated": "2026-10-26T20:10:00.160",
  "description": "A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.\n\nOlder, unsupported versions are also affected.",
  "id": "CVE-2026-22740",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Spring Framework",
            "vendor": "VMware",
            "versions": [
              {
                "lessThan": "7.0.7",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "6.2.18",
                "status": "affected",
                "version": "6.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "6.1.27",
                "status": "affected",
                "version": "6.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "5.3.48",
                "status": "affected",
                "version": "5.3.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@vmware.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "23C9BFA0-DDE5-4E6D-A9E0-ECC236913DF3",
                "versionEndExcluding": "5.3.48",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "FC58C148-219F-4868-B9F0-E0AF4435EF79",
                "versionEndExcluding": "6.1.27",
                "versionStartIncluding": "6.1.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "F317C66F-752D-40A9-AECF-5D1E51368AFE",
                "versionEndExcluding": "6.2.18",
                "versionStartIncluding": "6.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "78C5C95C-1A83-40E7-8C73-D5965E20BD06",
                "versionEndExcluding": "7.0.7",
                "versionStartIncluding": "7.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.\n\nOlder, unsupported versions are also affected."
      },
      {
        "lang": "es",
        "value": "Una aplicación de servidor WebFlux que procesa solicitudes multipart crea archivos temporales para partes de más de 10 K. Bajo ciertas circunstancias, los archivos temporales pueden permanecer sin eliminar después de que la solicitud se haya procesado completamente. Esto permite a un atacante consumir el espacio en disco disponible.\n\nLas versiones antiguas y no compatibles también se ven afectadas."
      }
    ],
    "id": "CVE-2026-22740",
    "lastModified": "2026-10-26T20:10:00.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "security@vmware.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-22740",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-29T11:55:51.268118Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-29T12:16:18.333",
    "references": [
      {
        "source": "security@vmware.com",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1"
      },
      {
        "source": "security@vmware.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://spring.io/security/cve-2026-22740"
      }
    ],
    "sourceIdentifier": "security@vmware.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-400"
          }
        ],
        "source": "security@vmware.com",
        "type": "Secondary"
      }
    ]
  },
  "severity": "MEDIUM",
  "source": "nvd",
  "title": "A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K"
}