CVE-2026-47891: Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If you are unable to upgrade immediately, mitigate the maxInMemorySize bypass by placing an external limit on request/response body sizes and/or XML payload sizes (e.g., via reverse proxy/WAF or network controls) so attackers cannot send arbitrarily large XML that the Jaxb2Decoder can parse into memory.
Event History
Frequently Asked Questions
Is every Spring WebFlux application in the listed release ranges exposed?
The issue is described for Spring WebFlux applications that rely on the Aalto XML processor to parse XML input. The provided information does not identify applications that do not use Aalto for XML parsing as affected by this condition.