CVE-2026-41849 | BDVDB-2026-338969 Detail
SpringSpring Framework
Description#
An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS). Affected versions: Spring Framework 5.3.0 through 5.3.48.
Impact#
An attacker who can supply user-controlled SpEL expressions can trigger an integer overflow in the evaluation logic, causing excessive resource consumption and denial of service.
Weaknesses#
- CWE-190 Integer Overflow or Wraparound
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.