A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

The version of Spring Framework installed on the remote host is 5.3.x prior to 5.3.48, 6.1.x prior to 6.1.27, 6.2.x prior to 6.2.18, or 7.0.x prior to 7.0.7. It is, therefore, affected by multiple vulnerabilities:

  - A WebFlux server application that processes multipart requests creates temp files for parts larger than 10K. Under     some circumstances, temp files may remain not deleted after the request is fully processed, allowing an attacker to     consume available disk space. (CVE-2026-22740)

  - Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources with caching     and encoded resources resolution enabled. An attacker can poison the resource cache with resources using the wrong     encoding, causing a denial of service. (CVE-2026-22741)

  - Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources from     the file system on Windows platforms. An attacker can send malicious requests that are slow to resolve and that can     keep HTTP connections in use. (CVE-2026-22745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A WebFlux server application that processes multipart requests creates temp files for parts larger than 10
    K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This
    allows an attacker to consume available disk space. Older, unsupported versions are also affected.
    (CVE-2026-22740)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A WebFlux server application that processes multipart requests creates temp files for parts larger than 10     K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This     allows an attacker to consume available disk space. Older, unsupported versions are also affected.
    (CVE-2026-22740)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
314917	Spring Framework 5.3.x < 5.3.48 / 6.1.x < 6.1.27 / 6.2.x < 6.2.18 / 7.0.x < 7.0.7 Multiple DoS	Nessus	Misc.	medium
441423	SCA: security update for org.springframework:spring-webflux (GHSA-5843-p793-ghmm)	Tenable Cloud Security	SCA Checks	medium
441423	SCA: security update for org.springframework:spring-webflux (GHSA-5843-p793-ghmm)	Tenable Self-Hosted Container Security	SCA Checks	medium
312216	Linux Distros Unpatched Vulnerability : CVE-2026-22740	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-22740

medium

Tenable Plugins

medium

medium

medium

medium