Spring Framework applications that use data binding can be tricked into creating an unbounded list of objects when a malicious property path is supplied. The framework repeatedly creates intermediate objects, consuming increasing amounts of memory until the server exhausts available resources. This uncontrolled resource consumption flaw (CWE‑400) allows an attacker to cause a denial of service by exhausting memory and potentially crashing the application.

The vulnerability affects all releases of Spring Framework from 5.2.25.RELEASE and earlier through 5.3.49, 6.0.0–6.0.30, 6.1.0–6.1.28, 6.2.0–6.2.19, and 7.0.0–7.0.8. Any application that employs Spring’s data binding to apply user‑supplied property paths is at risk. These versions are distributed under the Spring Framework product.

The CVE has a CVSS score of 7.5 and an EPSS score of less than 1%. It is not listed in the CISA KEV catalog. The attack vector is inferred to be via standard HTTP requests that deliver a specially crafted property path to an endpoint that uses automatic data binding. Although no exploitation evidence is cited, the uncontrolled memory allocation can be leveraged to degrade availability if an application processes many such requests and lacks throttling or resource limits.