{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59282.json" } ], "title": "org.springframework:spring-beans: Spring Framework: Denial of Service via unbounded list growth in data binding", "tracking": { "current_release_date": "2026-09-22T11:05:55+00:00", "generator": { "date": "2026-09-22T11:05:55+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.4.0" } }, "id": "CVE-2026-59282", "initial_release_date": "2026-08-27T17:57:38.575000+00:00", "revision_history": [ { "date": "2026-08-27T17:57:38.575000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-09-21T14:54:10.189907+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-09-22T11:05:55+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Developer Tools and Services", "product": { "name": "OpenShift Developer Tools and Services", "product_id": "openshift_developer_tools_and_services", "product_identification_helper": { "cpe": "cpe:/a:redhat:ocp_tools" } } } ], "category": "product_family", "name": "OpenShift Developer Tools and Services" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Apache Camel 4 for Quarkus 3", "product": { "name": "Red Hat build of Apache Camel 4 for Quarkus 3", "product_id": "red_hat_build_of_apache_camel_4_for_quarkus_3", "product_identification_helper": { "cpe": "cpe:/a:redhat:camel_quarkus:3" } } } ], "category": "product_family", "name": "Red Hat build of Apache Camel 4 for Quarkus 3" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Apache Camel - HawtIO 4", "product": { "name": "Red Hat build of Apache Camel - HawtIO 4", "product_id": "red_hat_build_of_apache_camel_-_hawtio_4", "product_identification_helper": { "cpe": "cpe:/a:redhat:apache_camel_hawtio:4" } } } ], "category": "product_family", "name": "Red Hat build of Apache Camel - HawtIO 4" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 10", "product": { "name": "Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:10" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux 10" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 8", "product": { "name": "Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 9", "product": { "name": "Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:9" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux 9" }, { "branches": [ { "category": "product_name", "name": "Red Hat Fuse 7", "product": { "name": "Red Hat Fuse 7", "product_id": "red_hat_fuse_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_fuse:7" } } } ], "category": "product_family", "name": "Red Hat Fuse 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Dev Spaces", "product": { "name": "Red Hat OpenShift Dev Spaces", "product_id": "red_hat_openshift_dev_spaces", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_devspaces:3" } } } ], "category": "product_family", "name": "Red Hat OpenShift Dev Spaces" }, { "category": "product_version", "name": "jenkins.src", "product": { "name": "jenkins.src", "product_id": "jenkins.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins?arch=src" } } }, { "category": "product_version", "name": "ocp-tools-4/jenkins-rhel8", "product": { "name": "ocp-tools-4/jenkins-rhel8", "product_id": "ocp-tools-4/jenkins-rhel8", "product_identification_helper": { "purl": "pkg:oci/jenkins-rhel8?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8" } } }, { "category": "product_version", "name": "ocp-tools-4/jenkins-rhel9", "product": { "name": "ocp-tools-4/jenkins-rhel9", "product_id": "ocp-tools-4/jenkins-rhel9", "product_identification_helper": { "purl": "pkg:oci/jenkins-rhel9?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9" } } }, { "category": "product_version", "name": "camel-quarkus-support-spring-beans", "product": { "name": "camel-quarkus-support-spring-beans", "product_id": "camel-quarkus-support-spring-beans", "product_identification_helper": { "purl": "pkg:maven/org.apache.camel.quarkus/camel-quarkus-support-spring-beans" } } }, { "category": "product_version", "name": "spring-beans", "product": { "name": "spring-beans", "product_id": "spring-beans", "product_identification_helper": { "purl": "pkg:maven/org.springframework/spring-beans" } } }, { "category": "product_version", "name": "extra-enforcer-rules.src", "product": { "name": "extra-enforcer-rules.src", "product_id": "extra-enforcer-rules.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/extra-enforcer-rules?arch=src" } } }, { "category": "product_version", "name": "extra-enforcer-rules-javadoc", "product": { "name": "extra-enforcer-rules-javadoc", "product_id": "extra-enforcer-rules-javadoc", "product_identification_helper": { "purl": "pkg:rpm/redhat/extra-enforcer-rules-javadoc" } } }, { "category": "product_version", "name": "velocity-javadoc", "product": { "name": "velocity-javadoc", "product_id": "velocity-javadoc", "product_identification_helper": { "purl": "pkg:rpm/redhat/velocity-javadoc" } } }, { "category": "product_version", "name": "velocity.src", "product": { "name": "velocity.src", "product_id": "velocity.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/velocity?arch=src" } } }, { "category": "product_version", "name": "guice-multibindings::javapackages-tools:201801", "product": { "name": "guice-multibindings (javapackages-tools:201801)", "product_id": "guice-multibindings::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-multibindings?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-parent::javapackages-tools:201801", "product": { "name": "guice-parent (javapackages-tools:201801)", "product_id": "guice-parent::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-parent?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "google-guice::javapackages-tools:201801", "product": { "name": "google-guice (javapackages-tools:201801)", "product_id": "google-guice::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/google-guice?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-jndi::javapackages-tools:201801", "product": { "name": "guice-jndi (javapackages-tools:201801)", "product_id": "guice-jndi::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-jndi?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-jmx::javapackages-tools:201801", "product": { "name": "guice-jmx (javapackages-tools:201801)", "product_id": "guice-jmx::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-jmx?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-extensions::javapackages-tools:201801", "product": { "name": "guice-extensions (javapackages-tools:201801)", "product_id": "guice-extensions::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-extensions?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-bom::javapackages-tools:201801", "product": { "name": "guice-bom (javapackages-tools:201801)", "product_id": "guice-bom::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-bom?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-servlet::javapackages-tools:201801", "product": { "name": "guice-servlet (javapackages-tools:201801)", "product_id": "guice-servlet::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-servlet?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-testlib::javapackages-tools:201801", "product": { "name": "guice-testlib (javapackages-tools:201801)", "product_id": "guice-testlib::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-testlib?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-grapher::javapackages-tools:201801", "product": { "name": "guice-grapher (javapackages-tools:201801)", "product_id": "guice-grapher::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-grapher?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "google-guice.src::javapackages-tools:201801", "product": { "name": "google-guice.src (javapackages-tools:201801)", "product_id": "google-guice.src::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/google-guice?arch=src&rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "google-guice-javadoc::javapackages-tools:201801", "product": { "name": "google-guice-javadoc (javapackages-tools:201801)", "product_id": "google-guice-javadoc::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/google-guice-javadoc?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-throwingproviders::javapackages-tools:201801", "product": { "name": "guice-throwingproviders (javapackages-tools:201801)", "product_id": "guice-throwingproviders::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-throwingproviders?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-assistedinject::javapackages-tools:201801", "product": { "name": "guice-assistedinject (javapackages-tools:201801)", "product_id": "guice-assistedinject::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-assistedinject?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "xbean.src::javapackages-tools:201801", "product": { "name": "xbean.src (javapackages-tools:201801)", "product_id": "xbean.src::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/xbean?arch=src&rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "xbean-javadoc::javapackages-tools:201801", "product": { "name": "xbean-javadoc (javapackages-tools:201801)", "product_id": "xbean-javadoc::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/xbean-javadoc?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "xbean::javapackages-tools:201801", "product": { "name": "xbean (javapackages-tools:201801)", "product_id": "xbean::javapackages-tools:201801", "product_identification_helper": { "purl": "pkg:rpm/redhat/xbean?rpmmod=javapackages-tools:201801" } } }, { "category": "product_version", "name": "guice-parent::maven:3.9", "product": { "name": "guice-parent (maven:3.9)", "product_id": "guice-parent::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-parent?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "google-guice::maven:3.9", "product": { "name": "google-guice (maven:3.9)", "product_id": "google-guice::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/google-guice?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "guice-jndi::maven:3.9", "product": { "name": "guice-jndi (maven:3.9)", "product_id": "guice-jndi::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-jndi?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "guice-jmx::maven:3.9", "product": { "name": "guice-jmx (maven:3.9)", "product_id": "guice-jmx::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-jmx?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "guice-extensions::maven:3.9", "product": { "name": "guice-extensions (maven:3.9)", "product_id": "guice-extensions::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-extensions?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "guice-bom::maven:3.9", "product": { "name": "guice-bom (maven:3.9)", "product_id": "guice-bom::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-bom?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "guice-servlet::maven:3.9", "product": { "name": "guice-servlet (maven:3.9)", "product_id": "guice-servlet::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-servlet?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "google-guice.src::maven:3.9", "product": { "name": "google-guice.src (maven:3.9)", "product_id": "google-guice.src::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/google-guice?arch=src&rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "guice-grapher::maven:3.9", "product": { "name": "guice-grapher (maven:3.9)", "product_id": "guice-grapher::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-grapher?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "google-guice-javadoc::maven:3.9", "product": { "name": "google-guice-javadoc (maven:3.9)", "product_id": "google-guice-javadoc::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/google-guice-javadoc?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "guice-throwingproviders::maven:3.9", "product": { "name": "guice-throwingproviders (maven:3.9)", "product_id": "guice-throwingproviders::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-throwingproviders?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "guice-assistedinject::maven:3.9", "product": { "name": "guice-assistedinject (maven:3.9)", "product_id": "guice-assistedinject::maven:3.9", "product_identification_helper": { "purl": "pkg:rpm/redhat/guice-assistedinject?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "devspaces/openvsx-rhel9", "product": { "name": "devspaces/openvsx-rhel9", "product_id": "devspaces/openvsx-rhel9", "product_identification_helper": { "purl": "pkg:oci/openvsx-rhel9?repository_url=registry.redhat.io/devspaces/openvsx-rhel9" } } }, { "category": "product_version", "name": "devspaces/pluginregistry-rhel9", "product": { "name": "devspaces/pluginregistry-rhel9", "product_id": "devspaces/pluginregistry-rhel9", "product_identification_helper": { "purl": "pkg:oci/pluginregistry-rhel9?repository_url=registry.redhat.io/devspaces/pluginregistry-rhel9" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jenkins.src as a component of OpenShift Developer Tools and Services", "product_id": "openshift_developer_tools_and_services:jenkins.src" }, "product_reference": "jenkins.src", "relates_to_product_reference": "openshift_developer_tools_and_services" }, { "category": "default_component_of", "full_product_name": { "name": "ocp-tools-4/jenkins-rhel8 as a component of OpenShift Developer Tools and Services", "product_id": "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8" }, "product_reference": "ocp-tools-4/jenkins-rhel8", "relates_to_product_reference": "openshift_developer_tools_and_services" }, { "category": "default_component_of", "full_product_name": { "name": "ocp-tools-4/jenkins-rhel9 as a component of OpenShift Developer Tools and Services", "product_id": "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9" }, "product_reference": "ocp-tools-4/jenkins-rhel9", "relates_to_product_reference": "openshift_developer_tools_and_services" }, { "category": "default_component_of", "full_product_name": { "name": "spring-beans as a component of Red Hat build of Apache Camel - HawtIO 4", "product_id": "red_hat_build_of_apache_camel_-_hawtio_4:spring-beans" }, "product_reference": "spring-beans", "relates_to_product_reference": "red_hat_build_of_apache_camel_-_hawtio_4" }, { "category": "default_component_of", "full_product_name": { "name": "camel-quarkus-support-spring-beans as a component of Red Hat build of Apache Camel 4 for Quarkus 3", "product_id": "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-spring-beans" }, "product_reference": "camel-quarkus-support-spring-beans", "relates_to_product_reference": "red_hat_build_of_apache_camel_4_for_quarkus_3" }, { "category": "default_component_of", "full_product_name": { "name": "extra-enforcer-rules-javadoc as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:extra-enforcer-rules-javadoc" }, "product_reference": "extra-enforcer-rules-javadoc", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "extra-enforcer-rules.src as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:extra-enforcer-rules.src" }, "product_reference": "extra-enforcer-rules.src", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "velocity-javadoc as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:velocity-javadoc" }, "product_reference": "velocity-javadoc", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "velocity.src as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:velocity.src" }, "product_reference": "velocity.src", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "google-guice-javadoc (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:google-guice-javadoc::javapackages-tools:201801" }, "product_reference": "google-guice-javadoc::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "google-guice.src (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:google-guice.src::javapackages-tools:201801" }, "product_reference": "google-guice.src::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "google-guice (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:google-guice::javapackages-tools:201801" }, "product_reference": "google-guice::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-assistedinject (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-assistedinject::javapackages-tools:201801" }, "product_reference": "guice-assistedinject::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-bom (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-bom::javapackages-tools:201801" }, "product_reference": "guice-bom::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-extensions (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-extensions::javapackages-tools:201801" }, "product_reference": "guice-extensions::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-grapher (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-grapher::javapackages-tools:201801" }, "product_reference": "guice-grapher::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-jmx (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-jmx::javapackages-tools:201801" }, "product_reference": "guice-jmx::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-jndi (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-jndi::javapackages-tools:201801" }, "product_reference": "guice-jndi::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-multibindings (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-multibindings::javapackages-tools:201801" }, "product_reference": "guice-multibindings::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-parent (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-parent::javapackages-tools:201801" }, "product_reference": "guice-parent::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-servlet (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-servlet::javapackages-tools:201801" }, "product_reference": "guice-servlet::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-testlib (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-testlib::javapackages-tools:201801" }, "product_reference": "guice-testlib::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "guice-throwingproviders (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:guice-throwingproviders::javapackages-tools:201801" }, "product_reference": "guice-throwingproviders::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "xbean-javadoc (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:xbean-javadoc::javapackages-tools:201801" }, "product_reference": "xbean-javadoc::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "xbean.src (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:xbean.src::javapackages-tools:201801" }, "product_reference": "xbean.src::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "xbean (javapackages-tools:201801) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:xbean::javapackages-tools:201801" }, "product_reference": "xbean::javapackages-tools:201801", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "google-guice-javadoc (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:google-guice-javadoc::maven:3.9" }, "product_reference": "google-guice-javadoc::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "google-guice.src (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:google-guice.src::maven:3.9" }, "product_reference": "google-guice.src::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "google-guice (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:google-guice::maven:3.9" }, "product_reference": "google-guice::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "guice-assistedinject (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:guice-assistedinject::maven:3.9" }, "product_reference": "guice-assistedinject::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "guice-bom (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:guice-bom::maven:3.9" }, "product_reference": "guice-bom::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "guice-extensions (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:guice-extensions::maven:3.9" }, "product_reference": "guice-extensions::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "guice-grapher (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:guice-grapher::maven:3.9" }, "product_reference": "guice-grapher::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "guice-jmx (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:guice-jmx::maven:3.9" }, "product_reference": "guice-jmx::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "guice-jndi (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:guice-jndi::maven:3.9" }, "product_reference": "guice-jndi::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "guice-parent (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:guice-parent::maven:3.9" }, "product_reference": "guice-parent::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "guice-servlet (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:guice-servlet::maven:3.9" }, "product_reference": "guice-servlet::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "guice-throwingproviders (maven:3.9) as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:guice-throwingproviders::maven:3.9" }, "product_reference": "guice-throwingproviders::maven:3.9", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "spring-beans as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:spring-beans" }, "product_reference": "spring-beans", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "devspaces/openvsx-rhel9 as a component of Red Hat OpenShift Dev Spaces", "product_id": "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9" }, "product_reference": "devspaces/openvsx-rhel9", "relates_to_product_reference": "red_hat_openshift_dev_spaces" }, { "category": "default_component_of", "full_product_name": { "name": "devspaces/pluginregistry-rhel9 as a component of Red Hat OpenShift Dev Spaces", "product_id": "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9" }, "product_reference": "devspaces/pluginregistry-rhel9", "relates_to_product_reference": "red_hat_openshift_dev_spaces" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-59282", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-08-27T20:19:47.944885+00:00", "flags": [ { "label": "vulnerable_code_not_in_execute_path", "product_ids": [ "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-spring-beans" ] }, { "label": "component_not_present", "product_ids": [ "red_hat_enterprise_linux_8:google-guice-javadoc::javapackages-tools:201801", "red_hat_enterprise_linux_8:google-guice.src::javapackages-tools:201801", "red_hat_enterprise_linux_8:google-guice::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-assistedinject::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-bom::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-extensions::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-grapher::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-jmx::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-jndi::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-multibindings::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-parent::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-servlet::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-testlib::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-throwingproviders::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean-javadoc::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean.src::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean::javapackages-tools:201801", "red_hat_enterprise_linux_9:google-guice-javadoc::maven:3.9", "red_hat_enterprise_linux_9:google-guice.src::maven:3.9", "red_hat_enterprise_linux_9:google-guice::maven:3.9", "red_hat_enterprise_linux_9:guice-assistedinject::maven:3.9", "red_hat_enterprise_linux_9:guice-bom::maven:3.9", "red_hat_enterprise_linux_9:guice-extensions::maven:3.9", "red_hat_enterprise_linux_9:guice-grapher::maven:3.9", "red_hat_enterprise_linux_9:guice-jmx::maven:3.9", "red_hat_enterprise_linux_9:guice-jndi::maven:3.9", "red_hat_enterprise_linux_9:guice-parent::maven:3.9", "red_hat_enterprise_linux_9:guice-servlet::maven:3.9", "red_hat_enterprise_linux_9:guice-throwingproviders::maven:3.9" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2525254" } ], "notes": [ { "category": "description", "text": "A flaw was found in Spring Framework. Applications utilizing Spring's data binding infrastructure to apply user-supplied property paths onto a target object are susceptible to a Denial of Service (DoS) attack. A remote attacker could exploit this by providing specially crafted input, leading to unbounded list growth and resource exhaustion. This can make the application unresponsive or crash it, preventing legitimate users from accessing the service.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.springframework:spring-beans: Spring Framework: Denial of Service via unbounded list growth in data binding", "title": "Vulnerability summary" }, { "category": "other", "text": "A flaw was found in Spring Framework's property data binding infrastructure within the `spring-beans` module (`AbstractNestablePropertyAccessor`). When processing user-supplied property paths against target objects exposing self-populating List properties, property path navigation invokes `list.get(index)` without validating array bounds after the `autoGrowCollectionLimit` check. A remote unauthenticated attacker can supply request parameters with arbitrarily large array indices to force unbounded element allocation. This leads to heap memory exhaustion, application thread unresponsiveness, and process termination, resulting in a denial of service (DoS). Default container resource limits constrain host-level impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "openshift_developer_tools_and_services:jenkins.src", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9", "red_hat_build_of_apache_camel_-_hawtio_4:spring-beans", "red_hat_enterprise_linux_10:extra-enforcer-rules-javadoc", "red_hat_enterprise_linux_10:extra-enforcer-rules.src", "red_hat_enterprise_linux_10:velocity-javadoc", "red_hat_enterprise_linux_10:velocity.src", "red_hat_fuse_7:spring-beans", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9" ], "known_not_affected": [ "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-spring-beans", "red_hat_enterprise_linux_8:google-guice-javadoc::javapackages-tools:201801", "red_hat_enterprise_linux_8:google-guice.src::javapackages-tools:201801", "red_hat_enterprise_linux_8:google-guice::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-assistedinject::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-bom::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-extensions::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-grapher::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-jmx::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-jndi::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-multibindings::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-parent::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-servlet::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-testlib::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-throwingproviders::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean-javadoc::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean.src::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean::javapackages-tools:201801", "red_hat_enterprise_linux_9:google-guice-javadoc::maven:3.9", "red_hat_enterprise_linux_9:google-guice.src::maven:3.9", "red_hat_enterprise_linux_9:google-guice::maven:3.9", "red_hat_enterprise_linux_9:guice-assistedinject::maven:3.9", "red_hat_enterprise_linux_9:guice-bom::maven:3.9", "red_hat_enterprise_linux_9:guice-extensions::maven:3.9", "red_hat_enterprise_linux_9:guice-grapher::maven:3.9", "red_hat_enterprise_linux_9:guice-jmx::maven:3.9", "red_hat_enterprise_linux_9:guice-jndi::maven:3.9", "red_hat_enterprise_linux_9:guice-parent::maven:3.9", "red_hat_enterprise_linux_9:guice-servlet::maven:3.9", "red_hat_enterprise_linux_9:guice-throwingproviders::maven:3.9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-59282" }, { "category": "external", "summary": "RHBZ#2525254", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525254" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59282", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59282" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59282", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59282" }, { "category": "external", "summary": "https://spring.io/security/cve-2026-59282", "url": "https://spring.io/security/cve-2026-59282" } ], "release_date": "2026-08-27T17:57:38.575000+00:00", "remediations": [ { "category": "workaround", "details": "Restrict property path data binding by explicitly configuring allowed fields via `DataBinder.setAllowedFields()` or `disallowedFields` on target controller endpoints. Alternatively, avoid exposing self-populating List properties on target DTO objects bound directly to untrusted web inputs.", "product_ids": [ "openshift_developer_tools_and_services:jenkins.src", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9", "red_hat_build_of_apache_camel_-_hawtio_4:spring-beans", "red_hat_enterprise_linux_10:extra-enforcer-rules-javadoc", "red_hat_enterprise_linux_10:extra-enforcer-rules.src", "red_hat_enterprise_linux_10:velocity-javadoc", "red_hat_enterprise_linux_10:velocity.src", "red_hat_fuse_7:spring-beans", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9" ] }, { "category": "none_available", "details": "Affected", "product_ids": [ "openshift_developer_tools_and_services:jenkins.src", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9", "red_hat_build_of_apache_camel_-_hawtio_4:spring-beans", "red_hat_enterprise_linux_10:extra-enforcer-rules-javadoc", "red_hat_enterprise_linux_10:extra-enforcer-rules.src", "red_hat_enterprise_linux_10:velocity-javadoc", "red_hat_enterprise_linux_10:velocity.src", "red_hat_fuse_7:spring-beans", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openshift_developer_tools_and_services:jenkins.src", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9", "red_hat_build_of_apache_camel_-_hawtio_4:spring-beans", "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-spring-beans", "red_hat_enterprise_linux_10:extra-enforcer-rules-javadoc", "red_hat_enterprise_linux_10:extra-enforcer-rules.src", "red_hat_enterprise_linux_10:velocity-javadoc", "red_hat_enterprise_linux_10:velocity.src", "red_hat_enterprise_linux_8:google-guice-javadoc::javapackages-tools:201801", "red_hat_enterprise_linux_8:google-guice.src::javapackages-tools:201801", "red_hat_enterprise_linux_8:google-guice::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-assistedinject::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-bom::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-extensions::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-grapher::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-jmx::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-jndi::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-multibindings::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-parent::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-servlet::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-testlib::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-throwingproviders::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean-javadoc::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean.src::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean::javapackages-tools:201801", "red_hat_enterprise_linux_9:google-guice-javadoc::maven:3.9", "red_hat_enterprise_linux_9:google-guice.src::maven:3.9", "red_hat_enterprise_linux_9:google-guice::maven:3.9", "red_hat_enterprise_linux_9:guice-assistedinject::maven:3.9", "red_hat_enterprise_linux_9:guice-bom::maven:3.9", "red_hat_enterprise_linux_9:guice-extensions::maven:3.9", "red_hat_enterprise_linux_9:guice-grapher::maven:3.9", "red_hat_enterprise_linux_9:guice-jmx::maven:3.9", "red_hat_enterprise_linux_9:guice-jndi::maven:3.9", "red_hat_enterprise_linux_9:guice-parent::maven:3.9", "red_hat_enterprise_linux_9:guice-servlet::maven:3.9", "red_hat_enterprise_linux_9:guice-throwingproviders::maven:3.9", "red_hat_fuse_7:spring-beans", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "openshift_developer_tools_and_services:jenkins.src", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8", "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9", "red_hat_build_of_apache_camel_-_hawtio_4:spring-beans", "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-quarkus-support-spring-beans", "red_hat_enterprise_linux_10:extra-enforcer-rules-javadoc", "red_hat_enterprise_linux_10:extra-enforcer-rules.src", "red_hat_enterprise_linux_10:velocity-javadoc", "red_hat_enterprise_linux_10:velocity.src", "red_hat_enterprise_linux_8:google-guice-javadoc::javapackages-tools:201801", "red_hat_enterprise_linux_8:google-guice.src::javapackages-tools:201801", "red_hat_enterprise_linux_8:google-guice::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-assistedinject::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-bom::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-extensions::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-grapher::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-jmx::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-jndi::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-multibindings::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-parent::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-servlet::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-testlib::javapackages-tools:201801", "red_hat_enterprise_linux_8:guice-throwingproviders::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean-javadoc::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean.src::javapackages-tools:201801", "red_hat_enterprise_linux_8:xbean::javapackages-tools:201801", "red_hat_enterprise_linux_9:google-guice-javadoc::maven:3.9", "red_hat_enterprise_linux_9:google-guice.src::maven:3.9", "red_hat_enterprise_linux_9:google-guice::maven:3.9", "red_hat_enterprise_linux_9:guice-assistedinject::maven:3.9", "red_hat_enterprise_linux_9:guice-bom::maven:3.9", "red_hat_enterprise_linux_9:guice-extensions::maven:3.9", "red_hat_enterprise_linux_9:guice-grapher::maven:3.9", "red_hat_enterprise_linux_9:guice-jmx::maven:3.9", "red_hat_enterprise_linux_9:guice-jndi::maven:3.9", "red_hat_enterprise_linux_9:guice-parent::maven:3.9", "red_hat_enterprise_linux_9:guice-servlet::maven:3.9", "red_hat_enterprise_linux_9:guice-throwingproviders::maven:3.9", "red_hat_fuse_7:spring-beans", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9" ] } ], "title": "org.springframework:spring-beans: Spring Framework: Denial of Service via unbounded list growth in data binding" } ] }