The PartEventHttpMessageReader in Spring WebFlux does not enforce the configured maxPartSize when maxInMemorySize is set to –1. This oversight allows an attacker to submit multipart requests containing parts that far exceed the intended memory limit, potentially exhausting server memory and causing the application to slow down or crash. The result is a denial‑of‑service condition that can impact the availability of services built on affected Spring Framework versions. The likely attack vector is sending oversized multipart requests over the network, based on the description.

Spring Framework versions 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, and 6.1.0 through 6.1.28 are affected. These releases are provided by Spring and represent the only publicly documented affected releases.

The CVSS score of 7.5 indicates high severity. The EPSS score of <1% indicates a low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the flaw does not require authentication; it is inferred that an attacker can exploit it over the network by sending specially crafted large multipart HTTP requests. Since the issue depends on the application accepting multipart payloads with maxInMemorySize set to –1, it is inferred that exploitation is straightforward when such a configuration is in place.