Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.

More precisely, an application can be vulnerable when all the following are true:

• The application uses Spring MVC or Spring WebFlux.
• The application accepts Multipart requests.
• The application is protected by a Web Application Firewall (WAF) or proxy that parses multipart requests and performs checks based on their content.

When all the conditions above are met, an attacker can send malicious multipart requests that can bypass the WAF/Proxy checks.