CVE-2026-59282: Spring Framework Denial of Service via Unbounded List Growth in Data Binding
Published Aug 27, 2026
·Updated
IBM Process Mining could allow a remote attacker to obtain sensitive information due to improper access control.
Other sources
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
— MITRE
Affected Software
13 affected components
Spring Spring Framework>=7.0.0<=7.0.8
Spring Spring Framework>=6.2.0<=6.2.19
Spring Spring Framework>=6.1.0<=6.1.28
Spring Spring Framework>=6.0.0<=6.0.30
Spring Spring Framework>=5.3.0<=5.3.49
Spring Spring Framework<5.2.25.RELEASE
VMware Spring Framework<5.2.26
VMware Spring Framework>=5.3.0<5.3.50
VMware Spring Framework>=6.0.0<6.0.31
VMware Spring Framework>=6.1.0<6.1.29
VMware Spring Framework>=6.2.0<6.2.20
VMware Spring Framework>=7.0.0<7.0.8.1
IBM Cloud Pak for Data System (Yosemite 1.0)<=11.3.1.2-IF1 - 11.3.1.2-IF2
Event History
Aug 27, 2026
CVE Published
via MITRE·05:57 PM
Data Sourced
via MITRE·05:57 PM
DescriptionWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Oct 21, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
Which Spring Framework release lines are within the stated affected ranges?
The stated ranges are 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.