CVE-2026-59282 Spring Framework Denial of Service via Unbounded List Growth in Data Binding

High 7.5 Published 27 Aug 2026 Updated 28 Aug 2026

Attackers can cause denial of service in Spring Framework applications by exploiting unbounded list growth during data binding of user-supplied property paths.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-59282?

CVE-2026-59282 is a high-severity denial of service vulnerability in Vmware Spring Framework, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Weakness: CWE-400

Which versions are affected by CVE-2026-59282?

It affects 1 product.

Products include Vmware Spring Framework.

How do I fix CVE-2026-59282?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-59282 being exploited?

There is no known exploitation of CVE-2026-59282 in the wild and no public exploit code.

All Vmware Spring Framework vulnerabilities

Sources

Also known as CLEANSTART-2026-KU24747, CLEANSTART-2026-MA96870, CLEANSTART-2026-RH20413, CLEANSTART-2026-YA06862, CLSA-2026-1788525613, CLSA-2026-1788526262 and 4 more.