ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
A flaw was found in Spring WebFlux applications that utilize the Aalto XML processor to parse XML input. A remote attacker could exploit this vulnerability by sending specially crafted XML, causing the application to bypass the maxInMemorySize limit. This can lead to excessive memory consumption, potentially resulting in a denial of service (DoS) condition for the application.
ΠΡΡΠ΅Ρ
CVE-2026-47891 affects Spring Framework's WebFlux module only when an application uses the reactive WebFlux stack together with the Aalto XML processor (com.fasterxml:aalto-xml) to parse XML request bodies. Red Hat products ship spring-web/spring-webflux transitively as part of servlet-based (Spring MVC) or non-web integrations; none run the reactive WebFlux XML-decode path, and the Aalto XML processor is not shipped in any Red Hat product (verified across the portfolio). The vulnerable code path is therefore never in execution, and these products are not affected.
ΠΠ΅ΡΡ ΠΏΠΎ ΡΠΌΡΠ³ΡΠ΅Π½ΠΈΡ ΠΏΠΎΡΠ»Π΅Π΄ΡΡΠ²ΠΈΠΉ
Not applicable to Red Hat products (not affected). Applications that do use Spring WebFlux with the Aalto XML processor should upgrade to a fixed Spring Framework release (7.0.9, 6.2.20, 6.1.29, 6.0.31, 5.3.50, or 5.2.26).
ΠΠ°ΡΡΠΎΠ½ΡΡΡΠ΅ ΠΏΠ°ΠΊΠ΅ΡΡ
| ΠΠ»Π°ΡΡΠΎΡΠΌΠ° | ΠΠ°ΠΊΠ΅Ρ | Π‘ΠΎΡΡΠΎΡΠ½ΠΈΠ΅ | Π Π΅ΠΊΠΎΠΌΠ΅Π½Π΄Π°ΡΠΈΡ | Π Π΅Π»ΠΈΠ· |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Not affected | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel8 | Not affected | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel9 | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-web | Not affected | ||
| Red Hat Enterprise Linux 7 | xbean | Not affected | ||
| Red Hat Enterprise Linux 8 | javapackages-tools:201801/xbean | Not affected | ||
| Red Hat Enterprise Linux 8 | pki-core:10.6/resteasy | Not affected | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/resteasy | Not affected | ||
| Red Hat Enterprise Linux 9 | resteasy | Not affected | ||
| Red Hat Enterprise Linux 9 | xbean | Not affected |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
Π‘ΡΡΠ»ΠΊΠΈ Π½Π° ΠΈΡΡΠΎΡΠ½ΠΈΠΊΠΈ
ΠΠΎΠΏΠΎΠ»Π½ΠΈΡΠ΅Π»ΡΠ½Π°Ρ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ
Π‘ΡΠ°ΡΡΡ:
EPSS
7.5 High
CVSS3
Π‘Π²ΡΠ·Π°Π½Π½ΡΠ΅ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
A Spring WebFlux application that relies on the Aalto XML processor to ...
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
EPSS
7.5 High
CVSS3