CVE-2026-47891

CVE-2026-47891 affects Spring WebFlux applications that use the Aalto XML processor to parse XML input, where the maxInMemorySize limit is not correctly enforced. The vulnerability resides specifically in the Jaxb2Decoder component, as identified in the Spring advisory, and is rated MEDIUM severi...

EUVD-2026-66859

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....