CVE-2026-59282: CWE-400 Uncontrolled Resource Consumption in Spring Spring Framework
Description
CVE-2026-59282 is a high severity vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It involves uncontrolled resource consumption due to the way Spring's data binding infrastructure applies user-supplied property paths to target objects, potentially leading to Denial of Service (DoS). The vulnerability does not impact confidentiality or integrity but can cause service disruption by exhausting resources. No official patch or remediation guidance is currently confirmed. Users should monitor vendor advisories for updates and apply fixes once available.
CVSS v3.1
Score 7.5high
Affected software
Spring
Spring Framework
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto target objects may be vulnerable to a Denial of Service (DoS) attack due to uncontrolled resource consumption (CWE-400). This affects versions 5.2.25.RELEASE and earlier, and all versions from 5.3.0 through 7.0.8. The vulnerability allows attackers to cause resource exhaustion, impacting availability without affecting confidentiality or integrity. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.
Potential Impact
The vulnerability can cause Denial of Service by exhausting system resources when processing maliciously crafted property paths in Spring's data binding. This impacts the availability of affected applications but does not compromise data confidentiality or integrity. There are no known active exploits at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of affected endpoints and applying any recommended configuration changes from the vendor. Monitor official Spring Framework advisories for updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- vmware
- Date Reserved
- 2026-07-04T18:13:26.297Z
- State
- PUBLISHED
Threat ID: 6a909cf5acd9273b49b2d01a
Added to database: 08/27/2026, 20:24:21 UTC
Last enriched: 09/08/2026, 10:52:28 UTC
Last updated: 10/10/2026, 06:48:18 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.