PT-2026-82409 · Vmware+1 · Spring Framework+1
CVE-2026-47891
·
Published
2026-08-27
·
Updated
2026-08-27
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Spring Framework versions 7.0.0 through 7.0.8
Spring Framework versions 6.2.0 through 6.2.19
Spring Framework versions 6.1.0 through 6.1.28
Spring Framework versions 6.0.0 through 6.0.30
Spring Framework versions 5.3.0 through 5.3.49
Spring Framework versions prior to 5.2.25.RELEASE
Description
A Spring WebFlux application using the Aalto XML processor to parse XML input fails to correctly enforce the
maxInMemorySize limit. This issue occurs within the Jaxb2Decoder component.Recommendations
Update to a version later than 7.0.8
Update to a version later than 6.2.19
Update to a version later than 6.1.28
Update to a version later than 6.0.30
Update to a version later than 5.3.49
Update to a version later than 5.2.25.RELEASE
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aalto Xml
Spring Framework