Spring Framework WebFlux XML reader (Aalto) MaxInMemorySize limit bypass (5.2-7.0)
CVE-2026-47891 Published on August 27, 2026
Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Products Associated with CVE-2026-47891
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Framework:- Version 7.0.0, <= 7.0.8 is affected.
- Version 6.2.0, <= 6.2.19 is affected.
- Version 6.1.0, <= 6.1.28 is affected.
- Version 6.0.0, <= 6.0.30 is affected.
- Version 5.3.0, <= 5.3.49 is affected.
- Before and including 5.2.25.RELEASE is affected.