Spring Framework applications that use the data binding infrastructure can be tricked into creating an unbounded list of objects when an attacker supplies a specially crafted property path. The framework repeatedly creates intermediate objects, causing memory to grow without bound. This flaw allows an attacker to exhaust server resources, resulting in a denial of service of the affected application. The weakness is an uncontrolled resource consumption flaw, rated with CWE-400.

The vulnerability affects all releases of Spring Framework from 5.2.25.RELEASE and earlier up through 5.3.49, 6.0.0 to 6.0.30, 6.1.0 to 6.1.28, 6.2.0 to 6.2.19, and 7.0.0 to 7.0.8. Any application that employs Spring’s data binding to apply user‑supplied property paths is at risk. The vendor identified in the CNA is Spring:Spring Framework.

The CVE does not provide a CVSS score or an EPSS estimate, and it is not listed in the CISA KEV catalog. Inferred from the description, the attack vector is likely via standard HTTP requests that deliver a malicious property path to an endpoint using data binding. Because the flaw causes uncontrolled memory allocation, the potential impact is high for applications that process many such requests and lack resource limits. No exploitation evidence is cited, but the nature of the flaw suggests it could be leveraged to degrade availability if an attacker can generate large numbers of property paths.