CVE-2026-47891 in Spring
Summary
by MITRE • 08/27/2026
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability described involves a critical configuration enforcement failure within the Spring WebFlux framework when it interacts with the Aalto XML processor for parsing incoming XML data streams. This issue specifically affects versions of the Spring Framework ranging from 5.2.25.RELEASE through to version 7.0.8, encompassing multiple maintenance releases across the 6.x and 5.x branches. The core technical flaw lies in how the framework handles memory limits during the parsing process. While developers configure a maximum input size limit via the maxInMemorySize property intended to prevent excessive resource consumption, this constraint is not correctly propagated or enforced by the underlying Aalto XML parser implementation within the reactive web stack. Consequently, the application fails to terminate or reject oversized payloads as expected, allowing an attacker to bypass memory protection mechanisms that are designed to safeguard against denial of service attacks.
From a technical perspective, this misconfiguration creates a pathway for resource exhaustion attacks. When an untrusted user submits XML data with a payload size exceeding the configured maxInMemorySize threshold, the Aalto processor continues to allocate heap memory without triggering the expected boundary checks or throwing the appropriate exceptions that would normally halt processing. This behavior effectively neutralizes one of the primary defenses against volumetric application-layer attacks. The lack of enforcement means that large XML documents can be processed entirely in memory, leading to rapid depletion of available JVM heap space. In a production environment hosting multiple tenants or services, this single point of failure can impact not only the affected service but potentially destabilize other components sharing the same resource pool if isolation is not strictly enforced at the infrastructure level.
The operational impact of this vulnerability is severe, primarily centering on Denial of Service conditions. An attacker can exploit this flaw by sending a series of moderately large XML requests that collectively exhaust server memory resources without necessarily requiring extremely massive individual payloads. This approach makes detection more difficult as traffic patterns may appear normal until system performance degrades significantly or the application crashes due to OutOfMemoryError exceptions. The availability impact is direct and immediate, leading to service outages for legitimate users. Furthermore, in environments where XML parsing triggers complex object instantiation or recursive data structures, memory consumption can accelerate even further, amplifying the severity of the resource exhaustion. There is also a secondary risk associated with this flaw; if the application subsequently attempts to serialize these large objects into other formats or store them in caches without proper size validation elsewhere, it could lead to broader system instability beyond just the initial parsing stage.
This vulnerability aligns closely with CWE-787: Out-of-bounds Write and CWE-400: Uncontrolled Resource Consumption, as the primary failure mode is the unregulated allocation of memory resources leading to system degradation or crash. In terms of offensive security frameworks, this flaw facilitates attacks categorized under MITRE ATT&CK technique T1496: Resource Hijacking, where adversaries consume computational resources to disrupt service availability. It also relates to T1055: Process Injection if the resulting instability leads to unexpected process behaviors that could be leveraged in more complex attack chains involving memory corruption or state manipulation. The lack of input size enforcement is a classic example of insufficient validation at the ingestion layer, which remains one of the most common vectors for application-layer denial of service incidents across modern web frameworks.
Mitigation strategies must focus on immediate version upgrades and configuration hardening. Organizations running affected versions of Spring Framework should upgrade to patched releases that correct the integration between WebFlux and Aalto XML processor to ensure maxInMemorySize limits are strictly enforced during parsing operations. For environments where an immediate patch is not feasible, administrators can implement network-level controls such as rate limiting or request size restrictions at the reverse proxy or load balancer layer to cap incoming payload sizes before they reach the application server. Additionally, enabling strict XML validation schemas and disabling external entity processing can reduce the attack surface associated with XML parsing vulnerabilities generally. Monitoring tools should be configured to alert on sudden spikes in memory usage or HTTP 500 errors related to out of memory conditions, allowing for rapid incident response when exploitation attempts are detected. Regular security assessments focusing on input handling boundaries are essential to prevent similar misconfigurations in other parts of the application stack.