CVE-2026-47891
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.
Risk Assessment
Incorrect enforcement of the limit may lead to excessive memory consumption, potentially resulting in denial of service (DoS).
Recommendation
Update Spring Framework to the latest available version that includes a fix for this vulnerability.
Original NVD description (English source)
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier