VMware Tanzu Spring Framework: Mehrere Schwachstellen ermöglichen Denial of Service

Summary

Product

Vulnerabilities 3

• Medium 6.5
  CVE-2026-22740

  Spring Framework DoS with Multipart Temp Files in WebFlux

  A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk s…

  VMware Spring Framework thingsboard-tb-node libspring-java Debian Ubuntu Wolfi Maven
  Apr 29, 2026
• Medium 5.3
  CVE-2026-22745

  CVE-2026-22745 : Denial of service in static resource handling on Windows platforms

  Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the ap…

  VMware Spring Framework thingsboard-tb-node thingsboard-tb-mqtt-transport Wolfi Maven
  Apr 29, 2026
• Low 3.1
  CVE-2026-22741

  Static resource cache poisoning in Spring MVC and WebFlux

  Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application …

  VMware Spring Framework thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 29, 2026

Revision history

1. 2026-06-07 #4

   Neue Updates von IBM aufgenommen

2. 2026-05-14 #3

   Neue Updates aufgenommen

3. 2026-04-29 #2

   Referenz(en) aufgenommen: EUVD-2026-26205, EUVD-2026-26207, EUVD-2026-26206

4. 2026-04-19 #1

   Initiale Fassung

References

• Spring Security Advisories vom 2026-04-19
  https://spring.io/security/cve-2026-22740
• Spring Security Advisories vom 2026-04-19
  https://spring.io/security/cve-2026-22741
• Spring Security Advisories vom 2026-04-19
  https://spring.io/security/cve-2026-22745
• PDFreactor 12.6.0 Changelog vom 2026-05-13
  https://www.pdfreactor.com/product/changelog.htm
• IBM Security Bulletin 7275303 vom 2026-06-06
  https://www.ibm.com/support/pages/node/7275303
• IBM Security Bulletin 7275306 vom 2026-06-06
  https://www.ibm.com/support/pages/node/7275306