EUVD-2026-66853

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

CVE-2026-47885

Spring WebFlux 's PartEventHttpMessageReader fails to enforce the maxPartSize limit when maxInMemorySize is set to -1 , meaning parts can exceed the configured size bound. This affects Spring Framework versions 7.0.0–7.0.8 , 6.2.0–6.2.19 , and 6.1.0–6.1.28 . The issue is rated MEDIUM severity per...