CVE-2018-1272: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versio...

Security readout for executives and security teams

This flaw affects older Spring Framework applications that relay user-supplied data into multipart requests sent to another server. An attacker may be able to insert an extra multipart value so the receiving server uses the wrong field, potentially changing identity or role data. Most exposed systems are Java applications using affected Spring Framework versions with MVC or WebFlux flows that proxy or compose outbound multipart requests from client-controlled input. Applications that do not build outbound multipart requests from remote input are less likely to be affected. Treat as a targeted remediation item for affected Spring-based services handling multipart workflows. Prioritize systems where uploaded or form-submitted data is forwarded to internal services and influences account identity, access level, or workflow authorization. Mitigation focus: Upgrade Spring Framework to 5.0.5, 4.3.15, or a supported later release.; Check Pivotal, Red Hat, and Oracle advisories for packaged dependency guidance.; Avoid constructing outbound multipart requests directly from untrusted client input..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.