The vulnerability allows an attacker to send specially crafted multipart HTTP requests to a Spring WebFlux application. The processing of these requests can exhaust server resources, leading to a denial of service. This weakness is categorized as CWE‑400 (Uncontrolled Resource Consumption), and can affect the availability of the affected application while it is under attack.

Spring Framework versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7 are vulnerable. Any application deployed with these releases that implements Spring WebFlux is at risk.

The CVSS score of 5.9 indicates a medium severity. No EPSS score is available, but the vulnerability is not listed in CISA KEV. The attack vector is likely remote via unauthenticated HTTP requests. An adversary only needs to send malformed multipart data; no special privileges or other conditions are mentioned. The impact is limited to the availability of the affected application, with no evidence of confidentiality or integrity compromise.