Log in Start free

Vulnerability · Published Aug 27, 2026 · Assigned by vmware

CVE-2026-47891Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder

Critical 9.8

In plain English

A critical-severity resource allocation without limits in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 55.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2026-47891
Debian:13libspring-javano fix listedDEBIAN-CVE-2026-47891
Debian:14libspring-javano fix listedDEBIAN-CVE-2026-47891
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2026-47891
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2026-47891

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 7.0.0 – through 7.0.86.2.0 – through 6.2.196.1.0 – through 6.1.286.0.0 – through 6.0.305.3.0 – through 5.3.490 – through 5.2.25.RELEASE

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References