Allocation of Resources Without Limits or Throttling in Spring Framework - CVE-2026-47891

Vulnerability identifier: #VU146224

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47891

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Jaxb2Decoder when parsing XML input with the Aalto XML processor. A remote attacker can send specially crafted XML content to cause a denial of service.

The issue affects Spring WebFlux applications that rely on the Aalto XML processor for XML parsing.

Spring Framework
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
IBM Sterling Control Center

Install security update from vendor's website.

Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
IBM Sterling Control Center - addressed in versions 6.3.1.0.12, 6.4.2.0.8
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0

• https://spring.io/security/cve-2026-47891

• Multiple vulnerabilities in Spring Framework
• Multiple vulnerabilities in IBM Library Support for Spring
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data