CVE-2026-59282

Analyzed Analyzed - Analysis Complete

Denial of Service in Spring Framework via Data Binding

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59282

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 6.2.0 (inc) to 6.2.20 (exc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.29 (exc)
vmware	spring_framework	From 5.3.0 (inc) to 5.3.50 (exc)
vmware	spring_framework	From 6.0.0 (inc) to 6.0.31 (exc)
vmware	spring_framework	to 5.2.26 (exc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Spring Framework applications using data binding to apply user-supplied property paths to target objects. If the target object contains a self-populating List with sub-properties, an attacker can send a property path with an extremely large index. This forces the list to allocate excessive memory, exhausting heap resources and causing a Denial of Service (DoS).

Detection Guidance

Check if your Spring Framework application uses data binding with user-supplied property paths. Monitor for unusually high memory usage or heap exhaustion during property binding operations. Review logs for excessive list allocations or nested sub-property access attempts.

Impact Analysis

An attacker could exploit this to crash your application by consuming all available memory, leading to downtime and service disruption. Systems with high user traffic or exposed endpoints handling user input are at higher risk of exploitation.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling a Denial of Service (DoS) attack. Such attacks may disrupt system availability, potentially violating GDPR's requirement for timely data access and HIPAA's requirement for continuous system operation.

Mitigation Strategies

Upgrade to fixed versions: Spring Framework 7.0.9 (OSS), 7.0.8.1 (Enterprise), 6.2.20 (Enterprise), 6.1.29 (Enterprise), 6.0.31 (Enterprise), 5.3.50 (Enterprise), or 5.2.26 (Enterprise). No additional mitigation steps are required after upgrading.

Hi! I’m here to help you understand CVE-2026-59282. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70