A Spring WebFlux application that uses the Aalto XML processor does not enforce the configured maxInMemorySize limit, allowing an attacker to send oversized XML payloads that bypass the restriction and consume unlimited memory, ultimately leading to application failure or unresponsiveness. The failure to constrain resource consumption results in a denial‑of‑service impact on availability, and if the crash exposes stack traces or other diagnostic data, there is a potential for confidentiality loss. The weakness relates to improper resource limit enforcement (CWE‑400).

Spring Framework versions 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and all 5.2.25.RELEASE versions and earlier are affected.

While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the lack of a memory size limit in these widely used framework versions suggests a high exploitation likelihood in environments where XML input is accepted, such as REST APIs over HTTP. An attacker could likely exploit the flaw by sending a large XML document to any vulnerable WebFlux endpoint, forcing the application to allocate memory beyond safe limits. The resulting denial‑of‑service can be catastrophic for services that require high availability. Consequently, the overall risk is considered elevated until mitigated.