Missing Release of Memory after Effective Lifetime

🗓️ 08 Jun 2026 00:00:00Reported by Snyk Security DatabaseType

WebFlux multipart processing may leak memory causing denial of service; upgrade spring-web to 6.0.0, 6.2.19, or 7.0.8+

Reporter	Title	Published	Views	Family All 53
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854]	27 Jul 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Cross-site Scripting attacks, Denial of Service (DoS) attacks, and Server-Side Request Forgery attacks	26 Jun 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway	15 Sep 202613:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	21 Jul 202605:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for July 2026 - Multiple CVEs addressed	10 Aug 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Software	20 Aug 202614:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:33	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Spring WebFlux affects IBM Netezza Appliance	12 Aug 202608:39	–	ibm
ATTACKERKB	CVE-2026-41840	9 Jun 202603:50	–	attackerkb
Chainguard	CVE-2026-41840 vulnerabilities	6 Aug 202620:28	–	cgr

Source	Link
cwe	www.cwe.mitre.org/data/definitions/CWE-401.html
security	www.security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520

08 Jun 2026 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 3.15.9

CVSS 48.2

EPSS0.00267

SSVC