Denial of Service Vulnerability in libspring-java: Spring Framework Data Binding
Summary
DEBIAN-CVE-2026-59282: Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Affects libspring-java versions 4.3.30-1 – 4.3.30-4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a library that provides the Spring Framework, a powerful framework for building Java applications. It facilitates data binding, allowing developers to map user input to Java objects seamlessly. However, certain versions of this library are vulnerable to a Denial of Service (DoS) attack due to improper handling of user-supplied property paths.
Vulnerability Detail
The vulnerability arises from the Spring Framework's data binding infrastructure, which can be exploited by attackers to apply malicious property paths onto target objects. This can lead to excessive resource consumption, causing the application to become unresponsive. The affected versions include Spring Framework 7.0.0 - 7.0.8, 6.2.0 - 6.2.19, 6.1.0 - 6.1.28, 6.0.0 - 6.0.30, 5.3.0 - 5.3.49, and 5.2.25.RELEASE and earlier.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize user-supplied property paths before they are processed by the data binding infrastructure. This can help mitigate the risk of a DoS attack.
Conclusion
The libspring-java package has a critical vulnerability that can lead to Denial of Service attacks due to improper data binding. It is essential to update to a patched version of the library to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for libspring-java →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The affected versions include Spring Framework 7.0.0 - 7.0.8, 6.2.0 - 6.2.19, 6.1.0 - 6.1.28, 6.0.0 - 6.0.30, 5.3.0 - 5.3.49, and 5.2.25.RELEASE and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
A Denial of Service (DoS) attack is a malicious attempt to disrupt the normal functioning of a targeted server, service, or network by overwhelming it with a flood of traffic or requests.
If you cannot update the package immediately, implement input validation to sanitize user inputs as a temporary measure to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
