CVE-2026-41850: Spring Framework SpEL Denial of Service Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-41850 is an algorithmic denial-of-service (CWE-407) flaw in Spring Framework's SpEL expression evaluator. When an application parses and evaluates a specially crafted SpEL expression supplied by an external user or untrusted source, the expression engine can enter pathological evaluation patterns that consume disproportionate system resources. The vulnerability does not involve code execution, authentication bypass, or data exposure—it strictly degrades availability. The attack vector is network-accessible and requires no privilege or user interaction, making it straightforward to exploit from a remote attacker's perspective.

Business impact

Applications using Spring Framework to evaluate user-supplied SpEL expressions face a direct availability risk. A remote attacker can trigger application hangs or crashes without authentication, potentially disrupting critical business services. The impact severity depends on the role of the affected application: if it's a core transaction processor, authentication service, or API gateway, a denial of service could cascade across dependent systems. Organizations relying on Spring for expression evaluation in dynamic query building, rule engines, or template processing should assess their deployment footprint immediately.

Affected systems

VMware Spring Framework versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7 are vulnerable. The vulnerability only manifests in applications that directly parse and evaluate untrusted SpEL expressions—for example, applications implementing custom expression-based query filters, rule engines, or dynamic templating. Applications that use Spring Framework but do not expose SpEL evaluation to external input are not impacted.

Exploitability

This vulnerability is readily exploitable. The attack requires no authentication, no special privileges, and no user interaction. An attacker only needs network access to submit a malicious SpEL expression to the vulnerable application. Proof-of-concept expressions can be relatively short and trivial to craft once the vulnerability is known. The low complexity of exploitation and high impact on availability make this an attractive target for opportunistic attackers and potential inclusion in automated attack tools.

Remediation

The primary remediation is to upgrade Spring Framework to patched versions. Consult the official VMware Spring Framework security advisory for the specific patched version numbers for your release line. As an interim mitigation, organizations should implement strict input validation and rate limiting on any endpoints that accept SpEL expressions, disable SpEL evaluation where possible, and monitor for unusual CPU or memory spikes that may indicate an active attack.

Patch guidance

Verify the latest patched version from the official VMware Spring Framework security advisory, as version numbers may vary by release branch. Once patched versions are released, prioritize upgrades for production systems that evaluate untrusted SpEL input. Test thoroughly in a staging environment first, as Spring Framework updates can occasionally impact application behavior. For applications on maintenance-only versions (e.g., Spring 5.x), confirm patch availability from VMware before planning upgrades.

Detection guidance

Monitor application logs for repeated or anomalous SpEL evaluation requests, particularly those with unusually complex or deeply nested expressions. Watch for sustained high CPU utilization or memory growth correlated with specific endpoints or request patterns. Network-level detection can flag repeated requests to endpoints known to process expressions. Endpoint protection tools may observe process resource exhaustion (CPU maxing out, memory growth) when this vulnerability is actively exploited. Log aggregation queries targeting expression evaluation errors or timeouts can help surface exploitation attempts.

Why prioritize this

This vulnerability scores 7.5 (HIGH) due to its network accessibility, lack of authentication requirement, and direct impact on application availability. Although it does not permit code execution or data theft, availability is a critical pillar of the CIA triad. The ease of exploitation and the breadth of affected Spring Framework versions elevate urgency. Organizations running Spring in production, especially in customer-facing or mission-critical roles, should treat this as a near-term priority.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network attack vector—the vulnerability is remotely exploitable over the network; (2) Low attack complexity—no special conditions or tricks are required to craft an exploitable expression; (3) No privileges or user interaction required; (4) High impact on availability through resource exhaustion; (5) No confidentiality or integrity impact. The severity is HIGH rather than CRITICAL because exploitation does not lead to unauthorized data access, code execution, or system compromise, only service degradation.

Frequently asked questions