Allocation of Resources Without Limits or Throttling in Spring Framework - CVE-2026-59282

Vulnerability identifier: #VU146230

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-59282

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Spring data binding infrastructure when applying user-supplied property paths onto a target object. A remote attacker can supply a property path with an arbitrarily large index into a nested sub-property to cause a denial of service.

Exploitation requires the target object to contain a self-populating list implementation as a property, and the list element type must expose sub-properties.

Spring Framework
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
IBM Sterling Control Center
IBM Netezza Performance Server

Install security update from vendor's website.

Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
IBM Sterling Control Center - addressed in versions 6.3.1.0.12, 6.4.2.0.8
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0
IBM Netezza Performance Server - update to 11.3.1.3 IF6

• https://spring.io/security/cve-2026-59282

• Multiple vulnerabilities in Spring Framework
• Multiple vulnerabilities in IBM Library Support for Spring
• IBM Control Center update for Spring Security
• Multiple vulnerabilities in IBM Netezza Performance Server
• Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data