## cve-2026-59282 - MEDIUM - Spring Framework Denial of Service via Unbounded List Growth in Data Binding

- 種別: advisory
- 関連技術: spring, java
- CVE: CVE-2026-59282
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-59282)
- パーマリンク: https://vulnpulse.app/items/spring-security-25f4366782a3

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework's property binding infrastructure traverses nested property paths by calling list.get(index) to navigate into list elements. This call is made without verifying that the index falls within the list's current bounds after the configured autoGrowCollectionLimit check prevents further growth. For standard List implementations this is safe, as an out-of-range get() throws IndexOutOfBoundsExcep…