A critical resource exhaustion vulnerability in the Spring Framework allows unauthenticated attackers to trigger excessive memory consumption via crafted XML input.

This is a resource allocation flaw (CWE-770) occurring when Spring WebFlux applications utilize the Aalto XML processor. Because the framework fails to correctly enforce the maxInMemorySize limit, an unauthenticated attacker can send malicious XML payloads to cause significant memory pressure.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of service disruption. Successful exploitation results in a denial of service, which can lead to extended system downtime, loss of availability for critical business applications, and potential cascading failures in downstream services.

Immediate Action: Upgrade to the latest patched version of the Spring Framework as specified in the official vendor security advisory.

Proactive Monitoring: Monitor application server logs and system resource metrics for sudden spikes in memory usage or frequent out of memory errors that correlate with inbound XML traffic.

Compensating Controls: Implement strict request size limits at the network edge or via a Web Application Firewall to block excessively large or malformed XML payloads before they reach the application layer.

Public Exploit Available: No

Given the critical severity of this vulnerability and the potential for unauthenticated remote exploitation, organizations should prioritize patching their Spring Framework instances immediately. Failure to remediate could leave infrastructure vulnerable to trivial denial of service attacks that could take down core business services.