CVE-2026-47891: CWE-770 Allocation of Resources Without Limits or Throttling in Spring Spring Framework
Description
CVE-2026-47891 is a critical vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It involves the Spring WebFlux application using the Aalto XML processor, which fails to properly enforce the maxInMemorySize limit. This can lead to uncontrolled resource allocation during XML parsing, potentially causing denial of service or other impacts.
CVSS v3.1
Score 9.8critical
Affected software
Spring
Spring Framework
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-770) occurs because Spring WebFlux applications relying on the Aalto XML processor do not correctly enforce the maxInMemorySize limit when parsing XML input. This lack of enforcement can result in allocation of resources without limits or throttling, which may be exploited to exhaust system resources. The affected versions include Spring Framework 5.2.25.RELEASE and earlier, and all versions up to 7.0.8 in the 6.x and 7.x branches as specified.
Potential Impact
The vulnerability allows an attacker to cause excessive resource consumption by sending specially crafted XML input that bypasses the maxInMemorySize limit. This can lead to denial of service due to memory exhaustion or degraded application performance. The CVSS score of 9.8 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Users should monitor the Spring Framework vendor advisories for updates and apply patches once available. Until then, consider limiting exposure of affected components or applying external resource limits if feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- vmware
- Date Reserved
- 2026-05-20T10:01:00.477Z
- State
- PUBLISHED
Threat ID: 6a8fd7beacd9273b49e17555
Added to database: 08/27/2026, 06:22:54 UTC
Last enriched: 09/09/2026, 13:22:26 UTC
Last updated: 10/09/2026, 18:48:20 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.