Executive brief
Spring WebFlux applications processing XML input through the Aalto XML processor fail to enforce memory size limits, allowing attackers to send malicious XML documents that consume excessive memory without triggering protections. This can cause denial of service by exhausting server resources and crashing the application, disrupting service availability for all users.
Technical details
The vulnerability is a resource exhaustion issue in Spring Framework's WebFlux module when using the Aalto XML processor for parsing XML input. The maxInMemorySize configuration parameter, which is intended to limit in-memory processing and prevent XML billion laughs or similar expansion attacks, is not correctly enforced. An attacker can send a specially crafted XML payload over the network to a vulnerable application without authentication, causing the parser to consume memory beyond the configured limit, leading to out-of-memory conditions and denial of service. The vulnerability affects Spring Framework versions 5.2.25 and earlier through 7.0.8.
Affected products
- VMware Spring Framework 5.2.25 and earlier, 5.3.0–5.3.49, 6.0.0–6.0.30, 6.1.0–6.1.28, 6.2.0–6.2.19, 7.0.0–7.0.8
Timeline
- 2026-08-27: disclosed