CVE-2026-41851: Spring Framework Denial of Service via Unbounded Cache in SpEL
Summary
CVE-2026-41851: Spring Framework Denial of Service via Unbounded Cache in SpEL. Affects org.springframework:spring-expression across 4 version ranges.
< 5.3.39
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.19
>= 7.0.0, < 7.0.8
Fixed in 5.3.39, 6.2.19 or 7.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, providing comprehensive infrastructure support for developing Java applications. It offers features such as dependency injection, aspect-oriented programming, and transaction management. However, certain versions of the Spring Framework are vulnerable to a Denial of Service (DoS) attack due to unbounded cache growth when processing user-supplied Spring Expression Language (SpEL) expressions.
Vulnerability Detail
The vulnerability arises from the way Spring Framework handles user-supplied SpEL expressions. If an application evaluates a malicious SpEL expression, it can lead to unbounded cache growth, consuming excessive memory and potentially crashing the application. This vulnerability affects multiple versions of the Spring Framework, making it critical for developers to address it promptly to prevent service disruptions.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.196.2.19 -
>= 7.0.0, < 7.0.87.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the complexity of SpEL expressions accepted by your application. Implement validation to restrict the types of expressions that can be evaluated, thereby reducing the risk of triggering unbounded cache growth.
Conclusion
CVE-2026-41851 is a significant vulnerability in the Spring Framework that can lead to Denial of Service attacks. It is crucial for developers using affected versions to update to the patched versions promptly and consider implementing workarounds to mitigate risks until they can upgrade.
See every vulnerability recorded for org.springframework:spring-expression →
FAQ
CVE-2026-41851 is a vulnerability in the Spring Framework that can lead to a Denial of Service (DoS) attack due to unbounded cache growth when evaluating user-supplied SpEL expressions.
Affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
If you cannot update immediately, implement validation on SpEL expressions to limit their complexity and reduce the risk of triggering the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-expression.
