Allocation of Resources Without Limits or Throttling Affecting org.springframework:spring-beans package, versions [,7.0.9)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-ORGSPRINGFRAMEWORK-19267072
- published26 Aug 2026
- disclosed20 Aug 2026
- creditUnknown
Introduced: 20 Aug 2026
NewCVE-2026-59282 (opens in a new tab)How to fix?
Upgrade org.springframework:spring-beans to version 7.0.9 or higher.
Overview
org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data binding. An attacker can exhaust system memory by supplying a crafted property path with a large index value, causing unbounded allocation of list elements when the target object contains a self-populating list whose element type exposes sub-properties.
Note: This is only exploitable if the application uses Spring's data binding infrastructure to apply user-supplied property paths onto a target object, the target object contains a self-populating list implementation as a property, and the list's element type exposes sub-properties.