Spring WebFlux applications are vulnerable to Denial of Service attacks when processing multipart requests, and attackers can send specially crafted multipart HTTP requests that exhaust server resources. This weakness is categorized as CWE-400 (Uncontrolled Resource Consumption) and CWE-401 (Memory Leak), and can affect the availability of the affected application while it is under attack.

Spring Framework versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7 are vulnerable. Any application deployed with these releases that implements Spring WebFlux is at risk.

The CVSS score of 5.9 indicates a medium severity. The EPSS score is below 1%, indicating a very low but non-zero likelihood of exploitation, but the vulnerability is not listed in CISA KEV. The attack vector is likely remote via unauthenticated HTTP requests. An adversary only needs to send malformed multipart data; no special privileges or other conditions are mentioned. The impact is limited to the availability of the affected application, with no evidence of confidentiality or integrity compromise.