XML Processing Vulnerability in Spring Framework by VMware
CVE-2026-47891

9.8CRITICAL

Key Information:

Vendor

Spring

Status
Spring Framework
Vendor
CVE Published:
27 August 2026

What is CVE-2026-47891?

A vulnerability in Spring Framework allows applications utilizing the Aalto XML processor to bypass the enforced maxInMemorySize limit when parsing XML input. This can lead to excessive memory consumption and potential denial of service (DoS) conditions, as the application may be unable to handle large XML payloads appropriately. Memory limits are critical for maintaining application stability and performance, making this flaw significant for developers relying on Spring for XML processing in their web applications.

Affected Version(s)

Spring Framework 7.0.0 <= 7.0.8

Spring Framework 6.2.0 <= 6.2.19

Spring Framework 6.1.0 <= 6.1.28

References

https://spring.io/security/cve-2026-47891

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.