Add a configurable limit for maximum nested property path depth

AbstractNestablePropertyAccessor resolves a nested property path
recursively, one recursive call per path segment, and there was
previously no limit on the nesting depth. Consequently, a sufficiently
deeply nested property path -- for example, against a self-referential
type -- could exhaust the current thread's call stack, resulting in a
StackOverflowError which lacks useful diagnostics for developers
attempting to assess what went wrong.

Note that the existing autoGrowCollectionLimit bounds array and
collection growth, not path depth.

The same is true for constructor binding via DataBinder.construct(),
which constructs a nested constructor argument recursively through a
nested property path. Path segments are constrained to declared
constructor parameters there, but a self-referential type nonetheless
permits an arbitrarily deep path.

With this commit, each property accessor tracks the number of nested
properties traversed to reach the object that it wraps, and an
InvalidPropertyException is thrown once the configured (or default)
maxNestedPathDepth limit is exceeded, with a message that reports the
configured limit. The limit applies regardless of autoGrowNestedPaths,
since resolving an existing deep object graph recurses in the same
manner as auto-growing one. Tracking the depth per property accessor
rather than threading it through the recursion allows the recursion to
dispatch through the protected
getPropertyAccessorForPropertyPath(String) method, which subclasses may
override, and avoids deriving the depth from the nested path, which
would require rescanning an ever longer path prefix at each level.

Constructor binding likewise tracks the nesting depth while
constructing nested objects as well as indexed and mapped elements, and
throws the same InvalidPropertyException once the limit is exceeded.

The maxNestedPathDepth (which defaults to 100) can be configured on a
per-use-case basis via ConfigurablePropertyAccessor or DataBinder,
which applies it to constructor binding directly and supplies it to the
property accessor via its binding result. In contrast to the auto-grow
collection limit, which is unlimited on a plain accessor, the nesting
depth is bounded by default even for programmatic property access,
since a large array or collection can be perfectly legitimate whereas a
deeply nested property path effectively never is.

Specifying zero for the maxNestedPathDepth disables support for nested
property paths altogether while continuing to allow simple, indexed,
and mapped property access, which is a reasonable way to constrain data
binding for a target object that is not intended to be traversed (such
as a flat DTO). However, negative values for maxNestedPathDepth are
always rejected.

Closes gh-37252

spring-context/src/main/java/org/springframework/validation/BeanPropertyBindingResult.java

@@ -23,6 +23,7 @@ import org.jspecify.annotations.Nullable;
 import org.springframework.beans.BeanWrapper;
 import org.springframework.beans.ConfigurablePropertyAccessor;
 import org.springframework.beans.PropertyAccessorFactory;
+import org.springframework.util.Assert;
 
 /**
  * Default implementation of the {@link Errors} and {@link BindingResult}
@@ -36,6 +37,7 @@ import org.springframework.beans.PropertyAccessorFactory;
  * {@link DataBinder#getBindingResult()}.
  *
  * @author Juergen Hoeller
+ * @author Sam Brannen
  * @since 2.0
  * @see DataBinder#getBindingResult()
  * @see DataBinder#initBeanPropertyAccess()
@@ -50,6 +52,8 @@ public class BeanPropertyBindingResult extends AbstractPropertyBindingResult imp
 
 	private final int autoGrowCollectionLimit;
 
+	private final int maxNestedPathDepth;
+
 	private transient @Nullable BeanWrapper beanWrapper;
 
 
@@ -68,14 +72,34 @@ public class BeanPropertyBindingResult extends AbstractPropertyBindingResult imp
 	 * @param objectName the name of the target object
 	 * @param autoGrowNestedPaths whether to "auto-grow" a nested path that contains a null value
 	 * @param autoGrowCollectionLimit the limit for array and collection auto-growing
+	 * @since 3.1
 	 */
 	public BeanPropertyBindingResult(@Nullable Object target, String objectName,
 			boolean autoGrowNestedPaths, int autoGrowCollectionLimit) {
 
+		this(target, objectName, autoGrowNestedPaths, autoGrowCollectionLimit,
+				ConfigurablePropertyAccessor.DEFAULT_MAX_NESTED_PATH_DEPTH);
+	}
+
+	/**
+	 * Create a new {@code BeanPropertyBindingResult} for the given target.
+	 * @param target the target bean to bind onto
+	 * @param objectName the name of the target object
+	 * @param autoGrowNestedPaths whether to "auto-grow" a nested path that contains a null value
+	 * @param autoGrowCollectionLimit the limit for array and collection auto-growing
+	 * @param maxNestedPathDepth the maximum nesting depth permitted for a nested
+	 * property path; must not be negative
+	 * @since 7.1
+	 */
+	public BeanPropertyBindingResult(@Nullable Object target, String objectName,
+			boolean autoGrowNestedPaths, int autoGrowCollectionLimit, int maxNestedPathDepth) {
+
 		super(objectName);
+		Assert.isTrue(maxNestedPathDepth >= 0, "'maxNestedPathDepth' must not be negative");
 		this.target = target;
 		this.autoGrowNestedPaths = autoGrowNestedPaths;
 		this.autoGrowCollectionLimit = autoGrowCollectionLimit;
+		this.maxNestedPathDepth = maxNestedPathDepth;
 	}
 
 
@@ -96,6 +120,7 @@ public class BeanPropertyBindingResult extends AbstractPropertyBindingResult imp
 			this.beanWrapper.setExtractOldValueForEditor(true);
 			this.beanWrapper.setAutoGrowNestedPaths(this.autoGrowNestedPaths);
 			this.beanWrapper.setAutoGrowCollectionLimit(this.autoGrowCollectionLimit);
+			this.beanWrapper.setMaxNestedPathDepth(this.maxNestedPathDepth);
 		}
 		return this.beanWrapper;
 	}

spring-context/src/main/java/org/springframework/validation/DataBinder.java

@@ -41,6 +41,7 @@ import org.jspecify.annotations.Nullable;
 import org.springframework.beans.BeanInstantiationException;
 import org.springframework.beans.BeanUtils;
 import org.springframework.beans.ConfigurablePropertyAccessor;
+import org.springframework.beans.InvalidPropertyException;
 import org.springframework.beans.MutablePropertyValues;
 import org.springframework.beans.PropertyAccessException;
 import org.springframework.beans.PropertyAccessorUtils;
@@ -167,6 +168,8 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 
 	private int autoGrowCollectionLimit = DEFAULT_AUTO_GROW_COLLECTION_LIMIT;
 
+	private int maxNestedPathDepth = ConfigurablePropertyAccessor.DEFAULT_MAX_NESTED_PATH_DEPTH;
+
 	private String @Nullable [] allowedFields;
 
 	private String @Nullable [] disallowedFields;
@@ -292,6 +295,37 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 		return this.autoGrowCollectionLimit;
 	}
 
+	/**
+	 * Specify the maximum nesting depth permitted for a nested property path.
+	 * <p>The nesting depth of a property path corresponds to the number of
+	 * intermediate properties that must be traversed in order to reach the final
+	 * property. For example, {@code "address.country.name"} has a nesting depth
+	 * of 2, since the {@code address} and {@code country} properties must be
+	 * traversed in order to reach the {@code name} property.
+	 * <p>Default is {@link ConfigurablePropertyAccessor#DEFAULT_MAX_NESTED_PATH_DEPTH}.
+	 * <p>Applies to setter and field injection via {@link #bind(PropertyValues)}
+	 * as well as to constructor binding via {@link #construct}, since a
+	 * constructor parameter which is itself an object is constructed recursively
+	 * through a nested property path.
+	 * @param maxNestedPathDepth the maximum nesting depth; must not be negative
+	 * @since 7.1
+	 * @see ConfigurablePropertyAccessor#setMaxNestedPathDepth(int)
+	 */
+	public void setMaxNestedPathDepth(int maxNestedPathDepth) {
+		Assert.state(this.bindingResult == null,
+				"DataBinder is already initialized - call setMaxNestedPathDepth before other configuration methods");
+		Assert.isTrue(maxNestedPathDepth >= 0, "'maxNestedPathDepth' must not be negative");
+		this.maxNestedPathDepth = maxNestedPathDepth;
+	}
+
+	/**
+	 * Return the maximum nesting depth permitted for a nested property path.
+	 * @since 7.1
+	 */
+	public int getMaxNestedPathDepth() {
+		return this.maxNestedPathDepth;
+	}
+
 	/**
 	 * Initialize standard JavaBean property access for this DataBinder.
 	 * <p>This is the default; an explicit call just leads to eager initialization.
@@ -310,8 +344,8 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 	 * @since 4.2.1
 	 */
 	protected AbstractPropertyBindingResult createBeanPropertyBindingResult() {
-		BeanPropertyBindingResult result = new BeanPropertyBindingResult(getTarget(),
-				getObjectName(), isAutoGrowNestedPaths(), getAutoGrowCollectionLimit());
+		BeanPropertyBindingResult result = new BeanPropertyBindingResult(getTarget(), getObjectName(),
+				isAutoGrowNestedPaths(), getAutoGrowCollectionLimit(), getMaxNestedPathDepth());
 
 		if (this.conversionService != null) {
 			result.initConversion(this.conversionService);
@@ -343,8 +377,8 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 	 * @since 4.2.1
 	 */
 	protected AbstractPropertyBindingResult createDirectFieldBindingResult() {
-		DirectFieldBindingResult result = new DirectFieldBindingResult(getTarget(),
-				getObjectName(), isAutoGrowNestedPaths(), getAutoGrowCollectionLimit());
+		DirectFieldBindingResult result = new DirectFieldBindingResult(getTarget(), getObjectName(),
+				isAutoGrowNestedPaths(), getAutoGrowCollectionLimit(), getMaxNestedPathDepth());
 
 		if (this.conversionService != null) {
 			result.initConversion(this.conversionService);
@@ -887,7 +921,7 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 		Assert.state(this.target == null, "Target instance already available");
 		Assert.state(this.targetType != null, "Target type not set");
 
-		this.target = createObject(this.targetType, "", valueResolver);
+		this.target = createObject(this.targetType, "", valueResolver, 0);
 
 		if (!getBindingResult().hasErrors()) {
 			this.bindingResult = null;
@@ -897,7 +931,9 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 		}
 	}
 
-	private @Nullable Object createObject(ResolvableType objectType, String nestedPath, ValueResolver valueResolver) {
+	private @Nullable Object createObject(ResolvableType objectType, String nestedPath,
+			ValueResolver valueResolver, int depth) {
+
 		Class<?> clazz = objectType.resolve();
 		boolean isOptional = (clazz == Optional.class);
 		clazz = (isOptional ? objectType.resolveGeneric(0) : clazz);
@@ -906,6 +942,14 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 					"Insufficient type information to create instance of " + objectType);
 		}
 
+		int maxNestedPathDepth = getMaxNestedPathDepth();
+		if (depth > maxNestedPathDepth) {
+			// The nested path always ends with a separator at this point, since the
+			// depth can only exceed the limit for a nested constructor argument.
+			throw new InvalidPropertyException(clazz, nestedPath.substring(0, nestedPath.length() - 1),
+					"Nesting depth of property path exceeds the maximum of " + maxNestedPathDepth);
+		}
+
 		Object result = null;
 		Constructor<?> ctor = BeanUtils.getResolvableConstructor(clazz);
 
@@ -938,18 +982,18 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 
 				if (value == null) {
 					if (List.class.isAssignableFrom(paramType)) {
-						value = createList(paramPath, paramType, resolvableType, valueResolver);
+						value = createList(paramPath, paramType, resolvableType, valueResolver, depth);
 					}
 					else if (Map.class.isAssignableFrom(paramType)) {
-						value = createMap(paramPath, paramType, resolvableType, valueResolver);
+						value = createMap(paramPath, paramType, resolvableType, valueResolver, depth);
 					}
 					else if (paramType.isArray()) {
-						value = createArray(paramPath, paramType, resolvableType, valueResolver);
+						value = createArray(paramPath, paramType, resolvableType, valueResolver, depth);
 					}
 				}
 
 				if (value == null && shouldConstructArgument(param) && hasValuesFor(paramPath, valueResolver)) {
-					args[i] = createObject(resolvableType, paramPath + ".", valueResolver);
+					args[i] = createObject(resolvableType, paramPath + ".", valueResolver, depth + 1);
 				}
 				else {
 					try {
@@ -1026,8 +1070,8 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 		return false;
 	}
 
-	private @Nullable List<?> createList(
-			String paramPath, Class<?> paramType, ResolvableType type, ValueResolver valueResolver) {
+	private @Nullable List<?> createList(String paramPath, Class<?> paramType, ResolvableType type,
+			ValueResolver valueResolver, int depth) {
 
 		ResolvableType elementType = type.getNested(2);
 		SortedSet<Integer> indexes = getIndexes(paramPath, valueResolver);
@@ -1045,14 +1089,14 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 		for (int index : indexes) {
 			String indexedPath = paramPath + "[" + (index != NO_INDEX ? index : "") + "]";
 			list.set(Math.max(index, 0),
-					createIndexedValue(paramPath, paramType, elementType, indexedPath, valueResolver));
+					createIndexedValue(paramPath, paramType, elementType, indexedPath, valueResolver, depth));
 		}
 
 		return list;
 	}
 
-	private <V> @Nullable Map<String, V> createMap(
-			String paramPath, Class<?> paramType, ResolvableType type, ValueResolver valueResolver) {
+	private <V> @Nullable Map<String, V> createMap(String paramPath, Class<?> paramType, ResolvableType type,
+			ValueResolver valueResolver, int depth) {
 
 		ResolvableType elementType = type.getNested(2);
 		Map<String, V> map = null;
@@ -1074,15 +1118,15 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 			}
 
 			String indexedPath = name.substring(0, endIdx + 1);
-			map.put(key, createIndexedValue(paramPath, paramType, elementType, indexedPath, valueResolver));
+			map.put(key, createIndexedValue(paramPath, paramType, elementType, indexedPath, valueResolver, depth));
 		}
 
 		return map;
 	}
 
 	@SuppressWarnings("unchecked")
-	private <V> @Nullable V @Nullable [] createArray(
-			String paramPath, Class<?> paramType, ResolvableType type, ValueResolver valueResolver) {
+	private <V> @Nullable V @Nullable [] createArray(String paramPath, Class<?> paramType, ResolvableType type,
+			ValueResolver valueResolver, int depth) {
 
 		ResolvableType elementType = type.getNested(2);
 		SortedSet<Integer> indexes = getIndexes(paramPath, valueResolver);
@@ -1097,7 +1141,7 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 		for (int index : indexes) {
 			String indexedPath = paramPath + "[" + (index != NO_INDEX ? index : "") + "]";
 			array[Math.max(index, 0)] =
-					createIndexedValue(paramPath, paramType, elementType, indexedPath, valueResolver);
+					createIndexedValue(paramPath, paramType, elementType, indexedPath, valueResolver, depth);
 		}
 
 		return array;
@@ -1129,19 +1173,19 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 	@SuppressWarnings("unchecked")
 	private <V> @Nullable V createIndexedValue(
 			String paramPath, Class<?> containerType, ResolvableType elementType,
-			String indexedPath, ValueResolver valueResolver) {
+			String indexedPath, ValueResolver valueResolver, int depth) {
 
 		Object value = null;
 		Class<?> elementClass = elementType.resolve(Object.class);
 
 		if (List.class.isAssignableFrom(elementClass)) {
-			value = createList(indexedPath, elementClass, elementType, valueResolver);
+			value = createList(indexedPath, elementClass, elementType, valueResolver, depth);
 		}
 		else if (Map.class.isAssignableFrom(elementClass)) {
-			value = createMap(indexedPath, elementClass, elementType, valueResolver);
+			value = createMap(indexedPath, elementClass, elementType, valueResolver, depth);
 		}
 		else if (elementClass.isArray()) {
-			value = createArray(indexedPath, elementClass, elementType, valueResolver);
+			value = createArray(indexedPath, elementClass, elementType, valueResolver, depth);
 		}
 		else {
 			Object rawValue = valueResolver.resolveValue(indexedPath, elementClass);
@@ -1154,7 +1198,7 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter {
 				}
 			}
 			else {
-				value = createObject(elementType, indexedPath + ".", valueResolver);
+				value = createObject(elementType, indexedPath + ".", valueResolver, depth + 1);
 			}
 		}
 

spring-context/src/main/java/org/springframework/validation/DirectFieldBindingResult.java

@@ -20,6 +20,7 @@ import org.jspecify.annotations.Nullable;
 
 import org.springframework.beans.ConfigurablePropertyAccessor;
 import org.springframework.beans.PropertyAccessorFactory;
+import org.springframework.util.Assert;
 
 /**
  * Special implementation of the Errors and BindingResult interfaces,
@@ -29,6 +30,7 @@ import org.springframework.beans.PropertyAccessorFactory;
  * <p>Since Spring 4.1 this implementation is able to traverse nested fields.
  *
  * @author Juergen Hoeller
+ * @author Sam Brannen
  * @since 2.0
  * @see DataBinder#getBindingResult()
  * @see DataBinder#initDirectFieldAccess()
@@ -43,6 +45,8 @@ public class DirectFieldBindingResult extends AbstractPropertyBindingResult {
 
 	private final int autoGrowCollectionLimit;
 
+	private final int maxNestedPathDepth;
+
 	private transient @Nullable ConfigurablePropertyAccessor directFieldAccessor;
 
 
@@ -62,7 +66,8 @@ public class DirectFieldBindingResult extends AbstractPropertyBindingResult {
 	 * @param autoGrowNestedPaths whether to "auto-grow" a nested path that contains a null value
 	 */
 	public DirectFieldBindingResult(@Nullable Object target, String objectName, boolean autoGrowNestedPaths) {
-		this(target, objectName, autoGrowNestedPaths, Integer.MAX_VALUE);
+		this(target, objectName, autoGrowNestedPaths, Integer.MAX_VALUE,
+				ConfigurablePropertyAccessor.DEFAULT_MAX_NESTED_PATH_DEPTH);
 	}
 
 	/**
@@ -71,15 +76,19 @@ public class DirectFieldBindingResult extends AbstractPropertyBindingResult {
 	 * @param objectName the name of the target object
 	 * @param autoGrowNestedPaths whether to "auto-grow" a nested path that contains a null value
 	 * @param autoGrowCollectionLimit the limit for array and collection auto-growing
+	 * @param maxNestedPathDepth the maximum nesting depth permitted for a nested
+	 * property path; must not be negative
 	 * @since 7.1
 	 */
 	public DirectFieldBindingResult(@Nullable Object target, String objectName,
-			boolean autoGrowNestedPaths, int autoGrowCollectionLimit) {
+			boolean autoGrowNestedPaths, int autoGrowCollectionLimit, int maxNestedPathDepth) {
 
 		super(objectName);
+		Assert.isTrue(maxNestedPathDepth >= 0, "'maxNestedPathDepth' must not be negative");
 		this.target = target;
 		this.autoGrowNestedPaths = autoGrowNestedPaths;
 		this.autoGrowCollectionLimit = autoGrowCollectionLimit;
+		this.maxNestedPathDepth = maxNestedPathDepth;
 	}
 
 
@@ -100,6 +109,7 @@ public class DirectFieldBindingResult extends AbstractPropertyBindingResult {
 			this.directFieldAccessor.setExtractOldValueForEditor(true);
 			this.directFieldAccessor.setAutoGrowNestedPaths(this.autoGrowNestedPaths);
 			this.directFieldAccessor.setAutoGrowCollectionLimit(this.autoGrowCollectionLimit);
+			this.directFieldAccessor.setMaxNestedPathDepth(this.maxNestedPathDepth);
 		}
 		return this.directFieldAccessor;
 	}

spring-context/src/test/java/org/springframework/validation/DataBinderConstructTests.java

@@ -27,16 +27,20 @@ import jakarta.validation.constraints.NotNull;
 import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.Test;
 
+import org.springframework.beans.ConfigurablePropertyAccessor;
+import org.springframework.beans.InvalidPropertyException;
 import org.springframework.core.ResolvableType;
 import org.springframework.format.support.DefaultFormattingConversionService;
 import org.springframework.util.Assert;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 
 /**
  * Tests for {@link DataBinder} with constructor binding.
  *
  * @author Rossen Stoyanchev
+ * @author Sam Brannen
  */
 class DataBinderConstructTests {
 
@@ -271,6 +275,35 @@ class DataBinderConstructTests {
 		assertThat(target.integerMapList().get(1)).containsOnly(Map.entry("a", 3), Map.entry("b", 4));
 	}
 
+	@Test  // gh-37252
+	void maxNestedPathDepth() {
+		DataBinder binder = initDataBinder(NodeRecord.class);
+		binder.setMaxNestedPathDepth(2);
+
+		// depth == max
+		binder.construct(new MapValueResolver(Map.of("next.next.value", "enigma")));
+		NodeRecord target = getTarget(binder);
+		assertThat(target.next().next().value()).isEqualTo("enigma");
+
+		// depth > max
+		DataBinder tooDeep = initDataBinder(NodeRecord.class);
+		tooDeep.setMaxNestedPathDepth(2);
+		assertThatExceptionOfType(InvalidPropertyException.class)
+				.isThrownBy(() -> tooDeep.construct(new MapValueResolver(Map.of("next.next.next.value", "enigma"))))
+				.withMessageEndingWith("Nesting depth of property path exceeds the maximum of 2");
+	}
+
+	@Test  // gh-37252
+	void maxNestedPathDepthProtectsAgainstStackOverflow() {
+		DataBinder binder = initDataBinder(NodeRecord.class);
+
+		String propertyPath = "next.".repeat(100_000) + "value";
+		assertThatExceptionOfType(InvalidPropertyException.class)
+				.isThrownBy(() -> binder.construct(new MapValueResolver(Map.of(propertyPath, "enigma"))))
+				.withMessageEndingWith("Nesting depth of property path exceeds the maximum of " +
+						ConfigurablePropertyAccessor.DEFAULT_MAX_NESTED_PATH_DEPTH);
+	}
+
 
 	@SuppressWarnings("SameParameterValue")
 	private static DataBinder initDataBinder(Class<?> targetType) {
@@ -341,6 +374,14 @@ class DataBinderConstructTests {
 	}
 
 
+	/**
+	 * A self-referential record, for which the nesting depth of a property path is
+	 * bounded by the supplied input rather than by the structure of the type.
+	 */
+	private record NodeRecord(@Nullable NodeRecord next, @Nullable String value) {
+	}
+
+
 	private record DataClassListRecord(List<DataClass> dataClassList) {
 	}
 

spring-context/src/test/java/org/springframework/validation/DataBinderFieldAccessTests.java

@@ -155,6 +155,29 @@ class DataBinderFieldAccessTests {
 				binder.bind(outOfBounds));
 	}
 
+	@Test  // gh-37252
+	void directFieldAccessHonorsMaxNestedPathDepth() {
+		TestBean rod = new TestBean("rod", 31);
+		TestBean kerry = new TestBean("kerry", 35);
+		rod.setSpouse(kerry);
+		kerry.setSpouse(rod);
+
+		DataBinder binder = new DataBinder(rod);
+		binder.setMaxNestedPathDepth(2);
+		binder.initDirectFieldAccess();
+
+		MutablePropertyValues pvs = new MutablePropertyValues();
+		pvs.add("spouse.spouse.name", "Jane");
+		binder.bind(pvs);
+		assertThat(rod.getName()).isEqualTo("Jane");
+
+		MutablePropertyValues tooDeep = new MutablePropertyValues();
+		tooDeep.add("spouse.spouse.spouse.name", "Joe");
+		assertThatExceptionOfType(InvalidPropertyException.class)
+				.isThrownBy(() -> binder.bind(tooDeep))
+				.withMessageEndingWith("Nesting depth of property path exceeds the maximum of 2");
+	}
+
 	@Test
 	void bindingWithErrorsAndCustomEditors() {
 		FieldAccessBean rod = new FieldAccessBean();

spring-context/src/test/java/org/springframework/validation/DataBinderTests.java

@@ -40,6 +40,7 @@ import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.beans.BeanWrapper;
+import org.springframework.beans.ConfigurablePropertyAccessor;
 import org.springframework.beans.InvalidPropertyException;
 import org.springframework.beans.MethodInvocationException;
 import org.springframework.beans.MutablePropertyValues;
@@ -2062,6 +2063,51 @@ class DataBinderTests {
 			.withMessageContaining("DataBinder is already initialized - call setAutoGrowCollectionLimit before other configuration methods");
 	}
 
+	@Test  // gh-37252
+	void defaultMaxNestedPathDepthIsAppliedToPropertyAccessor() {
+		DataBinder binder = new DataBinder(new TestBean(), "testBean");
+
+		assertThat(binder.getMaxNestedPathDepth())
+				.isEqualTo(ConfigurablePropertyAccessor.DEFAULT_MAX_NESTED_PATH_DEPTH);
+		assertThat(binder.getInternalBindingResult().getPropertyAccessor().getMaxNestedPathDepth())
+				.isEqualTo(ConfigurablePropertyAccessor.DEFAULT_MAX_NESTED_PATH_DEPTH);
+	}
+
+	@Test  // gh-37252
+	void setMaxNestedPathDepth() {
+		TestBean rod = new TestBean("rod", 31);
+		TestBean kerry = new TestBean("kerry", 35);
+		rod.setSpouse(kerry);
+		kerry.setSpouse(rod);
+
+		DataBinder binder = new DataBinder(rod);
+		binder.setMaxNestedPathDepth(2);
+
+		MutablePropertyValues pvs = new MutablePropertyValues();
+		pvs.add("spouse.spouse.name", "Jane");
+		binder.bind(pvs);
+		assertThat(rod.getName()).isEqualTo("Jane");
+
+		MutablePropertyValues tooDeep = new MutablePropertyValues();
+		tooDeep.add("spouse.spouse.spouse.name", "Joe");
+		assertThatExceptionOfType(InvalidPropertyException.class)
+				.isThrownBy(() -> binder.bind(tooDeep))
+				.withMessageEndingWith("Nesting depth of property path exceeds the maximum of 2");
+	}
+
+	@Test  // gh-37252
+	void setMaxNestedPathDepthAfterInitialization() {
+		DataBinder binder = new DataBinder(new TestBean());
+		binder.registerCustomEditor(String.class, new StringTrimmerEditor(true));
+
+		assertThatIllegalStateException()
+				.isThrownBy(() -> binder.setMaxNestedPathDepth(2))
+				.withMessageContaining("""
+					DataBinder is already initialized - \
+					call setMaxNestedPathDepth before other configuration methods\
+					""");
+	}
+
 	@Test  // SPR-15009
 	void setCustomMessageCodesResolverBeforeInitializeBindingResultForBeanPropertyAccess() {
 		TestBean testBean = new TestBean();