CVE-2026-47891
Description
A flaw was found in Spring WebFlux applications that utilize the Aalto XML processor to parse XML input. A remote attacker could exploit this vulnerability by sending specially crafted XML, causing the application to bypass the maxInMemorySize limit. This can lead to excessive memory consumption, potentially resulting in a denial of service (DoS) condition for the application.
Statement
CVE-2026-47891 affects Spring Framework's WebFlux module only when an application uses the reactive WebFlux stack together with the Aalto XML processor (com.fasterxml:aalto-xml) to parse XML request bodies. Red Hat products ship spring-web/spring-webflux transitively as part of servlet-based (Spring MVC) or non-web integrations; none run the reactive WebFlux XML-decode path, and the Aalto XML processor is not shipped in any Red Hat product (verified across the portfolio). The vulnerable code path is therefore never in execution, and these products are not affected.
Mitigation
Not applicable to Red Hat products (not affected). Applications that do use Spring WebFlux with the Aalto XML processor should upgrade to a fixed Spring Framework release (7.0.9, 6.2.20, 6.1.29, 6.0.31, 5.3.50, or 5.2.26).
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
