Spring Framework CVE-2026-59282

Exploitation requires that the target application (1) runs a vulnerable Spring Framework version (5.2.25.RELEASE or earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, or 7.0.0-7.0.8) AND (2) exposes at least one endpoint that passes user-supplied property path strings into Spring's data binding infrastructure - the typical case for Spring MVC controllers using @ModelAttribute or DataBinder directly. Applications that do not pass user-controlled strings as property path expressions to DataBinder are not affected. The CVSS vector PR:N/UI:N/AC:L confirms no authentication, user interaction, or elevated complexity is required once a vulnerable public binding endpoint is identified. Exploitation is bounded to Denial of Service; no confidentiality or integrity compromise is achievable. Applications that sanitize or allowlist property path inputs, or that require authentication before reaching binding endpoints, are at substantially reduced risk.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the worst case where a vulnerable data binding endpoint is publicly accessible without authentication - a realistic pattern for Spring MVC REST APIs and form controllers. However, the EPSS probability of 0.15% (4th percentile) is strikingly low given the severity score, indicating that at time of analysis, actual exploitation in the wild is minimal despite the broad attack surface. This CVE does not appear in the CISA KEV catalog, and no proof-of-concept is referenced in the available intelligence. The impact is strictly availability - C:N and I:N mean exploitation cannot yield data theft or code execution. The primary risk amplifier is Spring Framework's extraordinary deployment footprint: it underpins the majority of Java enterprise applications globally, so even a moderate exploitation rate across a wide install base translates to meaningful aggregate impact. Conversely, applications behind authentication, those that restrict user-supplied property paths via allowlisting, or those that do not expose data binding endpoints publicly are at substantially reduced real-world risk. This is a case where CVSS overstates urgency relative to current real-world signals - standard patch cycle prioritization is appropriate unless availability SLAs make DoS especially costly.

An attacker identifies a publicly accessible Spring MVC endpoint - such as a REST API or HTML form handler - that passes user-controlled request parameters through Spring's DataBinder to populate a domain object. The attacker submits an HTTP request containing a crafted property path expression engineered to trigger uncontrolled resource consumption in Spring's reflection-based property resolution engine, causing the application thread pool to exhaust CPU or memory and denying service to legitimate users. No authentication or special privileges are required if the endpoint is publicly reachable.