Description

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T06:17:20.287Z",
  "pubdate": "2026-08-27T06:17:20.287Z",
  "executiveSummary": "A vulnerability exists in Spring WebFlux applications utilizing the Aalto XML processor for XML input parsing. The flaw pertains to the improper enforcement of the maxInMemorySize limit during the parsing process. This vulnerability is classified as a Denial of Service (DoS) risk, specifically involving resource exhaustion.\nAffected products include Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.\nThe vulnerability allows an unauthenticated remote attacker to cause significant service degradation or total system unavailability by submitting maliciously crafted XML payloads. By bypassing memory constraints, an attacker can force the application to consume excessive heap memory, potentially triggering OutOfMemoryError (OOME) conditions. This impacts system availability and requires timely remediation to prevent service disruption.",
  "technicalDetails": "The root cause of this vulnerability lies in the integration layer between the Spring WebFlux framework and the Aalto XML processor. When the framework attempts to parse incoming XML request bodies, it is intended to enforce a 'maxInMemorySize' threshold to prevent excessive memory allocation during the deserialization or parsing phase. However, due to a failure in the configuration propagation or enforcement logic within the Spring Framework’s XML support, the Aalto processor does not strictly adhere to these memory limits.\nThe attack flow begins when an attacker sends a specially crafted XML document as part of an HTTP request to an endpoint that utilizes the vulnerable XML parser. The XML structure is designed to be highly complex or deep—often utilizing techniques common in XML entity expansion or large input streams—that causes the underlying Aalto XML parser to allocate heap memory beyond the intended threshold.\nBecause the 'maxInMemorySize' limit is ignored, the parser continues to buffer the XML content in the application's heap memory instead of rejecting the request or buffering to disk. As the payload is processed, the memory usage of the Spring WebFlux process increases linearly with the size and complexity of the malformed XML input. An attacker can repeat this process with multiple concurrent requests to exhaust available JVM heap memory rapidly.\nThe exploitation does not require authentication or elevated privileges, as it targets the request processing pipeline accessible to any user capable of reaching the application's XML-consuming endpoints. The network exposure is broad, as any public-facing WebFlux application configured to accept XML via Aalto is susceptible.\nPost-exploitation, the primary impact is a Denial of Service (DoS). When the JVM reaches its configured heap limit, it will trigger aggressive Garbage Collection (GC) cycles, resulting in severe latency. Continued exploitation leads to an 'java.lang.OutOfMemoryError', causing the application process to crash or become unresponsive. This necessitates a full service restart and potentially affects other services sharing the same underlying infrastructure if resource isolation is not strictly enforced at the container or OS level."
}