CVE-2026-41853: Spring Framework Multipart Request Smuggling Vulnerability in Spring MVC and WebFlux
Summary
CVE-2026-41853: Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux. Affects org.springframework:spring-webmvc across 4 version ranges.
< 5.3.39
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.19
>= 7.0.0, < 7.0.8
Fixed in 5.3.39, 6.2.19 or 7.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, particularly web applications. It provides comprehensive infrastructure support for developing Java applications and is widely used for its ease of integration and extensive features. However, certain versions of Spring MVC and WebFlux are vulnerable to Multipart request smuggling attacks, which can lead to unauthorized access and data manipulation.
Vulnerability Detail
The vulnerability arises from improper handling of multipart requests in Spring MVC and WebFlux applications. Attackers can exploit this flaw to smuggle malicious requests, potentially leading to unauthorized access to sensitive data or execution of unintended commands. This vulnerability affects multiple versions of the Spring Framework, making it critical for developers to address it promptly.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.196.2.19 -
>= 7.0.0, < 7.0.87.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization for multipart requests to mitigate the risk of request smuggling. Additionally, review and restrict the handling of multipart data in your application to minimize exposure.
Conclusion
The Spring Framework Multipart Request Smuggling vulnerability (CVE-2026-41853) poses a significant risk to applications using affected versions of Spring MVC and WebFlux. It is crucial for developers to update their dependencies to the latest patched versions to mitigate this vulnerability and protect their applications from potential attacks.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
Multipart request smuggling is an attack technique that exploits vulnerabilities in the way web applications handle multipart requests, allowing attackers to send malicious payloads that can bypass security controls.
The affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can provide real-time alerts. You can also check your application using the Vulert playground at Vulert Scanner without any signup.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
If you cannot update your dependencies immediately, implement input validation and restrict multipart request handling as a temporary measure to reduce risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
