CVE-2026-41849: Spring Expression Denial of Service via Integer Overflow
Summary
CVE-2026-41849: Spring Framework Denial of Service via Integer Overflow in SpEL Expressions. Affects org.springframework:spring-expression versions < 5.3.39. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Spring Framework is a powerful framework for building Java applications, providing comprehensive infrastructure support for developing Java applications. It includes features such as dependency injection, aspect-oriented programming, and a robust expression language (SpEL) for querying and manipulating objects at runtime. However, certain versions of the Spring Framework are vulnerable to an integer overflow issue in the SpEL evaluation logic, which can lead to Denial of Service (DoS) attacks.
Vulnerability Detail
An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). This vulnerability allows an attacker to craft a specially designed SpEL expression that can consume excessive resources, leading to a Denial of Service (DoS). The affected versions of the Spring Framework range from 5.3.0 to 5.3.48, making it critical for users of these versions to address the issue promptly to prevent potential service disruptions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing rate limiting or input validation to mitigate the risk of exploitation until the package can be updated.
Conclusion
The integer overflow vulnerability in the Spring Framework's SpEL can lead to significant service disruptions if not addressed. Users are strongly advised to update to the latest version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for org.springframework:spring-expression →
FAQ
CVE-2026-41849 is a vulnerability in the Spring Framework that allows for Denial of Service attacks via integer overflow in SpEL expressions.
The affected versions are Spring Framework 5.3.0 through 5.3.48.
Exploitation of this vulnerability can lead to excessive resource consumption, resulting in Denial of Service (DoS) for applications using the affected versions.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-expression.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
