CVE-2026-47891

Affected versions of the `org.springframework:spring-webflux` package are vulnerable to Denial of Service (DoS) due to the `maxInMemorySize` limit not being enforced on the XML decoding path that uses the Aalto XML processor. The WebFlux application accumulates the XML payload in memory without regard to the configured limit, rendering the memory ceiling ineffective when Aalto is used for XML parsing. An attacker can exploit this by sending a large XML body or multiple such requests, leading to heap exhaustion and potential application downtime.