CVE-2026-59282

About vulnerability

Spring Framework applications that use Spring’s data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.

Spring Framework’s property binding infrastructure traverses nested property paths by calling list.get(index) to navigate into list elements. This call is made without verifying that the index falls within the list’s current bounds after the configured autoGrowCollectionLimit check prevents further growth. For standard List implementations this is safe, as an out-of-range get() throws IndexOutOfBoundsException. However, a List implementation whose get() method allocates elements on demand rather than throwing IndexOutOfBoundsException may be caused to perform unbounded allocation.

Specifically, an application is vulnerable when all of the following conditions are met:

• The application uses Spring’s data binding infrastructure (e.g., DataBinder, BeanWrapper, or DirectFieldAccessor) to apply user-supplied property paths onto a target object.
• The target object contains a self-populating List implementation as a property.
• The list’s element type exposes sub-properties (i.e., it is not a simple scalar type).

When all conditions are met, an attacker can supply a property path with an arbitrarily large index into a nested sub-property, causing the list to allocate an unbounded number of elements, exhausting heap memory and potentially resulting in Denial of Service.

Affected product:

Apache CXF , Apache Log4j , Apache Struts , Apache Tapestry , Apache Tomcat , Eclipse Jetty , Spring , activemq , amqp-10-jms-spring-boot , artemis , azure-spring-data-cosmos , camel , castor , cocoon , crash , cypher-dsl , glassfish-hk2 , gora , grails-core , grails-data-mapping , grails-gsp , grails-plugin-converters , hornetq , java-sdk , jersey , karaf , micronaut-spring , pulsar , rest-assured , tika

Affected packages:

Spring Framework @ 6.2.12 (+12121 more)