Description

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.

More precisely, an application can be vulnerable when all the following are true:

• The application uses Spring MVC or Spring WebFlux.
• The application accepts Multipart requests.
• The application is protected by a Web Application Firewall (WAF) or proxy that parses multipart requests and performs checks based on their content.

When all the conditions above are met, an attacker can send malicious multipart requests that can bypass the WAF/Proxy checks.

Affected Spring Products and Versions

Spring Framework:

• 7.0.0 - 7.0.7
• 6.2.0 - 6.2.18
• 6.1.0 - 6.1.27
• 5.3.0 - 5.3.48

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This issue was responsibly reported by Yuki Matsuhashi.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N&version=3.1

History

• 2026-06-08: Initial vulnerability report published.