CLEANSTART-2026-RF89918: Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Q: What access does an attacker need to exploit this issue?

The attack vector is network-based and requires neither authentication nor user interaction. The listed metrics indicate low attack complexity.

Q: Which deployments should be prioritized for investigation?

Prioritize Rundeck deployments that run a Spring WebFlux application, accept XML input, and rely on the Aalto XML processor for parsing. The provided data does not identify affected versions or indicate whether default configurations are affected.

Q: What is the potential impact if exploitation succeeds?

The vulnerability is rated critical with high confidentiality, integrity, and availability impact in the supplied vector. This indicates a successful exploit could affect all three security properties.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47891

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack vector is network-based and requires neither authentication nor user interaction. The listed metrics indicate low attack complexity.

Which deployments should be prioritized for investigation?

Prioritize Rundeck deployments that run a Spring WebFlux application, accept XML input, and rely on the Aalto XML processor for parsing. The provided data does not identify affected versions or indicate whether default configurations are affected.

What is the potential impact if exploitation succeeds?

The vulnerability is rated critical with high confidentiality, integrity, and availability impact in the supplied vector. This indicates a successful exploit could affect all three security properties.

CLEANSTART-2026-RF89918: Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments should be prioritized for investigation?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments should be prioritized for investigation?

What is the potential impact if exploitation succeeds?