cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. PartEventHttpMessageReader is used when controller a method has an @RequestBody Flux<PartEvent> argument.
| CVE | CVE-2026-47885 |
|---|---|
| 情報源 | Spring Security Advisories |
| 取得日時 | 2026/10/22 01:17 |
| データ | Markdown JSON |
2026/08/20 09:00、Spring Security Advisoriesが「cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader」を公開しました (種別: 脆弱性アドバイザリ)。関連する技術: Spring、Java。CVE: CVE-2026-47885。