A Spring WebFlux application that handles multipart requests creates temporary files for parts larger than 10 KB. In certain circumstances those temp files are not removed after the request completes, allowing an attacker to deliberately consume all available disk space. This vulnerability corresponds to CWE‑400 and results in a denial‑of‑service condition by exhausting storage resources.

The affected product is VMware Spring Framework. Older, unsupported versions are also vulnerable, though specific version numbers are not listed in the advisory.

The likely attack vector is an unauthenticated, network‑based HTTP multipart request. The CVSS score of 6.5 indicates moderate severity. Because the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, the precise exploitation likelihood appears low, but an attacker could repeatedly submit multipart payloads that leave residual temp files and consume disk space, causing a denial‑of‑service. The lack of automatic cleanup provides a straightforward attack path that does not require privileged access, making it a risk for any publicly accessible WebFlux service.