What is GHSA-5843-p793-ghmm?

GHSA-5843-p793-ghmm is a security advisory published by GitHub Security Advisories with Medium severity. Spring Framework DoS with Multipart Temp Files in WebFlux

Which CVE IDs does GHSA-5843-p793-ghmm cover?

GHSA-5843-p793-ghmm covers the following CVE IDs: CVE-2026-22740. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5843-p793-ghmm?

GHSA-5843-p793-ghmm has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-5843-p793-ghmm?

GHSA-5843-p793-ghmm affects 4 products, including: maven/org.springframework:spring-webflux:\u003e= 7.0.0, \u003c= 7.0.6; maven/org.springframework:spring-webflux:\u003e= 6.2.0, \u003c= 6.2.17; maven/org.springframework:spring-webflux:\u003e= 6.1.0, \u003c= 6.1.26; maven/org.springframework:spring-webflux:\u003c= 5.3.47.

GHSA-5843-p793-ghmmMediumCVSS 6.5

Spring Framework DoS with Multipart Temp Files in WebFlux

Vendor

GitHub Security Advisories

Published

April 29, 2026

Last Modified

July 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-22740 →

📋 Description

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.

Older, unsupported versions are also affected.

🎯 Affected products4

maven/org.springframework:spring-webflux:>= 7.0.0, <= 7.0.6
maven/org.springframework:spring-webflux:>= 6.2.0, <= 6.2.17
maven/org.springframework:spring-webflux:>= 6.1.0, <= 6.1.26
maven/org.springframework:spring-webflux:<= 5.3.47

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-22740
https://spring.io/security/cve-2026-22740
https://github.com/advisories/GHSA-5843-p793-ghmm