External risk intelligence

Spring WebFlux XML Parsing Vulnerability Affects Max Size Limit.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-47891

This vulnerability affects Spring WebFlux applications, which are commonly deployed as internet-facing web services or APIs. Since the flaw involves processing XML input within these web-accessible components, the vulnerable surface is frequently exposed to the public internet in standard deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Spring WebFlux applications that use the Aalto XML processor, potentially allowing for denial-of-service attacks by overwhelming memory resources. This issue is classified as critical and has a high potential for external exploitation due to the common use of these applications as internet-facing services.

XML processing flaw can exhaust system memory.
Affects web applications, increasing exposure risk.
Confirm if affected web services are internet-facing.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted XML data to a Spring WebFlux application that uses the Aalto XML processor. If the application fails to properly validate the size of the incoming XML, it could lead to a denial-of-service condition or potentially allow for arbitrary code execution.

Publicly accessible web service entry.
Malicious XML input is parsed.
Potential for denial-of-service or code execution.

Live Threat

Current exploitation, exposure, and threat context

A Spring WebFlux application using the Aalto XML processor could be susceptible to resource exhaustion when parsing XML input, due to an improperly enforced memory size limit. This could affect the availability of the application and potentially lead to denial-of-service conditions when processing malformed or excessively large XML payloads.

Application availability.
Via processing crafted XML input.
Service may become unresponsive.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Spring WebFlux applications, due to improper XML parsing, will likely require collaboration between application owners and infrastructure teams. The first practical step is to identify all instances of the affected Spring Framework versions, assess their reachability and business criticality, and then determine the specific accountable teams for remediation planning.

Application and platform teams own remediation.
Verify affected Spring Framework deployments.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Spring Framework and why is it used?

Spring Framework is a foundational Java platform used to build modern, enterprise-grade web applications and APIs. Spring WebFlux specifically provides a non-blocking, reactive programming model that helps services handle many concurrent connections efficiently. It is a backbone technology for many cloud-native systems, serving as the bridge between incoming web traffic and backend logic.

What does CVE-2026-47891 mean for XML processing?

This vulnerability involves a weakness classified as CWE-770, which is an allocation of resources without limits. In this case, the Aalto XML processor fails to enforce a maximum memory size limit when parsing data. When an application accepts XML, it must be able to reject inputs that are too large. Because this limit is ignored, the system can be forced to consume excessive memory, leading to a crash or service failure.

How can an attacker trigger this memory exhaustion?

An attacker triggers this by sending a specially crafted, excessively large XML payload to an application endpoint that uses the Aalto processor. It is important to note that sending standard, well-formed, and small XML documents will not trigger this bug; the vulnerability specifically relies on the application's failure to stop the processing of malformed or oversized input before it exhausts system resources.

Is my Spring WebFlux application at risk?

If your application uses the affected Spring Framework versions and integrates the Aalto XML processor, it is potentially at risk. According to Halo Surface Signal, because Spring WebFlux applications are frequently deployed as internet-facing APIs, the vulnerable code is often directly reachable from the public internet. If your service processes XML from external users, it should be considered a priority for assessment.

What are the first steps to address this vulnerability?

Begin by auditing your infrastructure to create an inventory of all applications running the listed versions of the Spring Framework. Once identified, consult with your application and platform teams to confirm if they rely on the Aalto XML processor. Prioritize these findings based on business criticality and network reachability to plan and schedule necessary updates or configuration changes.

References

spring.io/security/cve-2026-47891

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.