CVE-2026-59282

Affected versions of the `org.springframework:spring-beans` package are vulnerable to Denial of Service (DoS) because a property path supplied by the caller is resolved against the target object without bounding the work the path implies. The data binding infrastructure in Spring allows request parameters to be bound onto an object, enabling the request to dictate the depth and breadth of traversal. An attacker can exploit this by submitting crafted property paths, or multiple paths in a single request, leading to excessive CPU and memory consumption during the binding process.