Vulnerability details
CVE-2026-59282
Spring Framework
Spring Framework Denial of Service via Unbounded List Growth in Data Binding
CVSS 3.1
7.5High
Official description
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Spring | Spring Framework | v ≤ 5.2.25.RELEASE | CVEProject cvelistV5 (CNA) |
| Spring | Spring Framework | 5.3.0 ≤ v ≤ 5.3.49 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Framework | 6.0.0 ≤ v ≤ 6.0.30 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Framework | 6.1.0 ≤ v ≤ 6.1.28 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Framework | 6.2.0 ≤ v ≤ 6.2.19 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Framework | 7.0.0 ≤ v ≤ 7.0.8 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-27
- Last updated
- 2026-08-28
- State
- Published
- Assigner (CNA)
- vmware
Exploit prediction (EPSS)
0.46%
Probability of exploitation in 30 days
40.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-400Uncontrolled Resource Consumption