CVE-2026-47891: Spring Framework XXE Vulnerability

CVE-2026-47891 Overview

CVE-2026-47891 affects Spring Framework applications that use Spring WebFlux with the Aalto XML processor. The framework fails to correctly enforce the maxInMemorySize limit when parsing XML input through Aalto. Attackers can send crafted XML payloads that bypass the configured memory ceiling. This allocation bypass can lead to excessive memory consumption and denial-of-service conditions in reactive Spring applications.

Critical Impact
A Spring WebFlux endpoint that consumes XML through Aalto may accept payloads exceeding the intended maxInMemorySize threshold, exhausting heap memory and disrupting service availability.

Affected Products

Spring Framework 7.0.0 through 7.0.8
Spring Framework 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, and 6.0.0 through 6.0.30
Spring Framework 5.3.0 through 5.3.49 and 5.2.25.RELEASE and earlier

Discovery Timeline

2026-08-27 - CVE-2026-47891 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47891

Vulnerability Analysis

Spring WebFlux provides a reactive XML decoder that enforces a maxInMemorySize limit on buffered input. This limit prevents unbounded memory allocation while decoding streaming XML bodies. When the underlying parser is the Aalto asynchronous XML processor, the size check does not apply consistently. The decoder continues to buffer incoming bytes past the configured maximum. Applications that expose XML-consuming endpoints therefore lose the memory safety control they expect from the framework.

Root Cause

The defect lies in how the Aalto-backed decoder integrates with Spring's reactive buffer accounting. The maxInMemorySize guard, which normally aborts decoding once buffered content exceeds the threshold, is not enforced along the Aalto code path. This is an input validation and resource management issue that maps to uncontrolled resource consumption behavior.

Attack Vector

A remote client sends an HTTP request with an XML body to a Spring WebFlux endpoint that decodes XML using Aalto. The attacker inflates the payload beyond the configured maxInMemorySize value. Because the limit is not enforced, the server allocates memory proportional to the request body. Repeated or concurrent requests amplify heap pressure and can trigger OutOfMemoryError conditions, degrading or halting the application.

No verified proof-of-concept code has been published. Refer to the Spring Security Advisory CVE-2026-47891 for authoritative technical details.

Detection Methods for CVE-2026-47891

Indicators of Compromise

Repeated HTTP POST or PUT requests to WebFlux endpoints with Content-Type: application/xml or text/xml containing oversized bodies.
JVM logs showing OutOfMemoryError, long garbage collection pauses, or heap saturation correlated with XML traffic.
Sudden increases in reactor Netty buffer allocations tied to XML decoding.

Detection Strategies

Inspect application dependencies for com.fasterxml:aalto-xml on the classpath alongside vulnerable spring-web and spring-webflux versions.
Instrument XML-consuming controllers to log request body sizes and reject payloads that exceed business-defined limits at the gateway.
Correlate WAF telemetry for large XML bodies with backend latency spikes and JVM memory metrics.

Monitoring Recommendations

Track heap usage, GC pause duration, and thread pool saturation on WebFlux services processing XML.
Alert on HTTP 5xx bursts on XML endpoints and on repeated client IPs sending oversized XML payloads.
Monitor Spring Boot Actuator metrics such as jvm.memory.used and http.server.requests for anomalies.

How to Mitigate CVE-2026-47891

Immediate Actions Required

Upgrade Spring Framework to a fixed release published in the Spring Security Advisory CVE-2026-47891.
Enforce request body size limits at the reverse proxy, ingress controller, or API gateway for all XML endpoints.
Audit WebFlux services to identify those that accept XML input and depend on Aalto.

Patch Information

Spring has published fixed versions covering the 5.3.x, 6.0.x, 6.1.x, 6.2.x, and 7.0.x branches. Apply the vendor-recommended upgrade for the branch in use. See the Spring Security Advisory CVE-2026-47891 for the exact patched versions and upgrade guidance.

Workarounds

Remove the Aalto XML processor from the classpath if XML parsing is not required, forcing Spring to fall back to the default decoder that enforces maxInMemorySize.
Terminate XML requests at an upstream proxy that caps body size before traffic reaches the WebFlux application.
Disable or restrict XML content negotiation on endpoints that only need JSON.

bash

# Example NGINX gateway control to cap XML request bodies
client_max_body_size 256k;