The bug in Spring WebFlux's PartEventHttpMessageReader ignores the maxPartSize when the maxInMemorySize is set to -1, allowing an attacker to send multipart requests with parts that exceed the intended memory size limit. This can exhaust server memory, leading to service slowdown or crash, effectively denying legitimate traffic. The vulnerability is a form of resource‑exhaustion flaw.

Spring Framework versions 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, and 6.1.0 through 6.1.28 are affected. These are the only publicly documented affected releases, and all are provided by the Spring vendor.

No EPSS score is available and the vulnerability is not listed in CISA KEV. The CVSS score is not supplied, but the severity can be inferred as high due to the denial‑of‑service potential. The likely attack vector is the network, with an attacker sending crafted multipart HTTP requests from outside the organization. Because the flaw is not dependent on authentication and has no known mitigations within the app itself, exploitation is considered straightforward if the server accepts large multipart payloads.