The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.
Spring Framework 7.0.0 – 7.0.8
Spring Framework 6.2.0 – 6.2.19
Spring Framework 6.1.0 – 6.1.28
HIGH
Vulnerability intelligence
CVE-2026-47885
CVSS 3.17.5
SeverityHigh
Known exploitedNo
NVD references:
Primary source: NIST National Vulnerability Database