CVE-2026-59282

Overview

Spring Framework is a widely used application framework for the Java platform that provides the core programming and configuration model for modern Java enterprise applications, including the data binding infrastructure in its spring-beans module. Data binding applies external name/value pairs, such as HTTP request parameters bound to an @ModelAttribute command object, onto the properties of a target object; DataBinder, BeanWrapper, and DirectFieldAccessor share a common base, AbstractNestablePropertyAccessor, that walks a nested property path such as list[2].name one segment at a time. So that binding into an indexed collection stays convenient, the accessor can grow a List on demand, bounded by a configurable autoGrowCollectionLimit.

A denial of service vulnerability (CVE-2026-59282) has been identified in AbstractNestablePropertyAccessor, which allows attackers to exhaust the memory of an affected server by supplying a property path with an arbitrarily large list index, because after the autoGrowCollectionLimit check has prevented further growth the accessor still calls list.get(index) without verifying that the index is within the list's bounds. An application is only exposed when it applies user-supplied property paths onto a target object that exposes a self-populating List property whose element type has sub-properties.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

The advisory rates this vulnerability Medium severity with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, which corresponds to a base score of 5.9. The attack vector is Network because the property path is influenced by an ordinary HTTP request, no privileges or user interaction are required, attack complexity is High because the target object must expose an unusual self-populating List property for the missing bounds check to be reachable, and the Availability impact is High because the unbounded allocation drives the JVM to exhaust its heap.

This issue affects Spring Framework <=5.2.25, >=5.3.0 <=5.3.49, >=6.0.0 <=6.0.30, >=6.1.0 <=6.1.28, >=6.2.0 <=6.2.19, and >=7.0.0 <=7.0.8, including the End-of-Life 4.3.x, 5.3.x, 6.1.x, and 6.2.x lines supported by NES for Spring Framework.

Details

Module Info

• Product: Spring Framework
• Affected packages: org.springframework:spring-beans
• Affected versions: <=5.2.25, >=5.3.0 <=5.3.49, >=6.0.0 <=6.0.30, >=6.1.0 <=6.1.28, >=6.2.0 <=6.2.19, >=7.0.0 <=7.0.8
• GitHub repository: https://github.com/spring-projects/spring-framework
• Published packages: https://central.sonatype.com/artifact/org.springframework/spring-beans
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Framework nes-v4.3.40, nes-v5.3.54, nes-v6.1.30, and nes-v6.2.21
  • Spring Framework 7.0.9 (OSS)

Vulnerability Info

This Medium-severity vulnerability is found in the spring-beans package in multiple versions of Spring Framework. When AbstractNestablePropertyAccessor reads an indexed segment of a nested property path, getPropertyValue navigates into a List element by growing the list if needed and then fetching the element:

else if (value instanceof List list) {
    int index = Integer.parseInt(key);
    growCollectionIfNecessary(list, index, indexedPropertyName.toString(), ph, i + 1);
    value = list.get(index);
}

growCollectionIfNecessary only appends elements while the requested index is at or beyond the current size and still below autoGrowCollectionLimit; once the index reaches that limit (or auto-growing is disabled), it returns without growing the list any further. The code above then calls list.get(index) on an index it knows may be out of range, relying on a standard List to throw IndexOutOfBoundsException, which the enclosing handler converts into an InvalidPropertyException. That assumption is the flaw: a self-populating List whose get() allocates the missing elements on demand rather than throwing never signals the out-of-range access, so the bound is silently bypassed and index + 1 elements are allocated. This path is reached both when reading list[N] and when writing a nested value such as list[N].prop, whose intermediate list[N] segment is resolved through getPropertyValue before the final property is set.

Because the index is parsed directly from the property path, an attacker who can influence a bound path can supply a value up to 2147483647. On a target object whose List property self-populates and whose element type exposes sub-properties, that single request forces the accessor to allocate an enormous number of elements, exhausting the heap and rendering the service unavailable regardless of the configured autoGrowCollectionLimit.

This vulnerability was introduced in 2009 with Spring Framework 3.0.0.RELEASE.

Steps to Reproduce

1. Add an affected version of spring-beans to a project, for example 6.2.19, and run the following. It defines a target bean whose List property is self-populating and whose element type has a sub-property, sets a small autoGrowCollectionLimit, and binds a property path with a large index:

public class Bean {
    private String prop;
    public String getProp() { return prop; }
    public void setProp(String prop) { this.prop = prop; }
}

public class SelfPopulatingList extends ArrayList<Bean> {
    @Override
    public Bean get(int index) {
        while (size() <= index) {
            add(new Bean());
        }
        return super.get(index);
    }
}

public class Target {
    private List<Bean> list = new SelfPopulatingList();
    public List<Bean> getList() { return list; }
    public void setList(List<Bean> list) { this.list = list; }
}

BeanWrapperImpl wrapper = new BeanWrapperImpl(new Target());
wrapper.setAutoGrowNestedPaths(true);
wrapper.setAutoGrowCollectionLimit(2);
wrapper.getPropertyValue("list[1000000].prop");

2. Observe that the call returns normally and the backing list has grown to 1000001 elements even though autoGrowCollectionLimit is 2. A larger index, up to list[2147483647], forces a correspondingly larger allocation until the heap is exhausted.

3. Repeat the same call on a patched version, for example 7.0.9, and observe that it throws InvalidPropertyException reporting "Cannot get element with index 1000000 from List of size 0" instead of allocating, because the index is now bounds-checked once the auto-grow limit applies.

‍

Mitigation

Only recent versions of Spring Framework receive community support. The 4.3.x, 5.3.x, 6.1.x, and 6.2.x lines are End-of-Life and will not receive public updates to address this issue, so there is no publicly available fix for those lines other than through a commercial support partner.

Applications that cannot upgrade immediately can reduce their exposure by ensuring that objects used as data binding targets do not expose self-populating List properties whose get() allocates elements on demand; a standard List such as ArrayList throws IndexOutOfBoundsException for an out-of-range index and is not affected. Restricting the property paths a binder will accept, for example with DataBinder.setAllowedFields, further limits which indexes an attacker can reach.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Framework. The open-source fix ships in Spring Framework 7.0.9 on the 7.0.x line.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, which provides the fix for the 4.3.x, 5.3.x, 6.1.x, and 6.2.x lines in nes-v4.3.40, nes-v5.3.54, nes-v6.1.30, and nes-v6.2.21.

Credits

• No public finder credit is listed in the advisory sources checked for this entry.