CVE-2026-47891

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName contains "java" or FileName contains "spring-boot"
| where ProcessCommandLine contains "webflux" and ProcessCommandLine contains "xml"
| summarize TotalMemoryUsage = sum(WorkingSetSize), ProcessCount = count() by DeviceName, ProcessCommandLine
| where TotalMemoryUsage > <threshold_bytes> // Schwellenwert für ungewöhnlich hohen Speicherverbrauch
| project DeviceName, ProcessCommandLine, TotalMemoryUsage, ProcessCount

Splunk SPL

index=<your_index> (sourcetype=java OR sourcetype=spring) (process="java" OR process="spring-boot") "webflux" "xml"
| stats sum(mem_usage) as TotalMemoryUsage, count as ProcessCount by host, command
| where TotalMemoryUsage > <threshold_bytes>
| table host, command, TotalMemoryUsage, ProcessCount

Sigma

title: Spring WebFlux Aalto XML maxInMemorySize Bypass
status: experimental
description: Detects potential exploitation attempts of CVE-2026-47891 in Spring WebFlux applications using Aalto XML by monitoring for excessive memory consumption related to XML processing.
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: 
      - '\java'
      - '\spring-boot'
    CommandLine|contains:
      - 'webflux'
      - 'xml'
  condition: selection
  # Further conditions for memory usage would require host-based monitoring agents
  # and would be highly dependent on the specific logging infrastructure.
  # This rule primarily focuses on identifying relevant processes.
level: high

Elastic ES|QL

FROM logs-*-* 
| WHERE process.executable.name : ("java", "spring-boot") AND process.args : ("webflux", "xml")
| STATS TotalMemoryUsage = SUM(process.memory.rss.bytes), ProcessCount = COUNT() BY host.name, process.command_line
| WHERE TotalMemoryUsage > <threshold_bytes>
| SELECT host.name, process.command_line, TotalMemoryUsage, ProcessCount