Описание
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
A flaw was found in Spring Framework. Applications utilizing Spring's data binding infrastructure to apply user-supplied property paths onto a target object are susceptible to a Denial of Service (DoS) attack. A remote attacker could exploit this by providing specially crafted input, leading to unbounded list growth and resource exhaustion. This can make the application unresponsive or crash it, preventing legitimate users from accessing the service.
Отчет
A flaw was found in Spring Framework's property data binding infrastructure within the spring-beans module (AbstractNestablePropertyAccessor). When processing user-supplied property paths against target objects exposing self-populating List properties, property path navigation invokes list.get(index) without validating array bounds after the autoGrowCollectionLimit check. A remote unauthenticated attacker can supply request parameters with arbitrarily large array indices to force unbounded element allocation. This leads to heap memory exhaustion, application thread unresponsiveness, and process termination, resulting in a denial of service (DoS). Default container resource limits constrain host-level impact.
Меры по смягчению последствий
Restrict property path data binding by explicitly configuring allowed fields via DataBinder.setAllowedFields() or disallowedFields on target controller endpoints. Alternatively, avoid exposing self-populating List properties on target DTO objects bound directly to untrusted web inputs.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | camel-quarkus-support-spring-beans | Not affected | ||
| Red Hat build of Apache Camel - HawtIO 4 | spring-beans | Affected | ||
| Red Hat Enterprise Linux 10 | extra-enforcer-rules | Not affected | ||
| Red Hat Enterprise Linux 10 | velocity | Not affected | ||
| Red Hat Enterprise Linux 8 | javapackages-tools:201801/google-guice | Not affected | ||
| Red Hat Enterprise Linux 8 | javapackages-tools:201801/xbean | Not affected | ||
| Red Hat Enterprise Linux 9 | maven:3.9/google-guice | Not affected | ||
| Red Hat Fuse 7 | spring-beans | Not affected | ||
| OpenShift Developer Tools and Services 4.12 | ocp-tools-4/jenkins-rhel8 | Fixed | RHSA-2026:88152 | 22.10.2026 |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Spring Framework applications that use Spring's data binding infrastru ...
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
7.5 High
CVSS3