CLEANSTART-2026-FV80975: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...

Q: Which deployments are exposed to this issue?

Deployments are exposed if the application evaluates Spring Expression Language expressions supplied by users and permits expressions using the power operator with BigDecimal or BigInteger operands.

Q: What does an attacker need to trigger the denial of service?

An attacker needs the ability to submit a SpEL expression for evaluation. The expression must use the power operator (^) with a BigDecimal or BigInteger operand and a large exponent value.

Q: What is the expected impact of successful exploitation?

Successful exploitation can cause a denial of service. The provided impact data indicates availability impact only, with no stated confidentiality or integrity impact.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47886

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments are exposed if the application evaluates Spring Expression Language expressions supplied by users and permits expressions using the power operator with BigDecimal or BigInteger operands.

What does an attacker need to trigger the denial of service?

An attacker needs the ability to submit a SpEL expression for evaluation. The expression must use the power operator (^) with a BigDecimal or BigInteger operand and a large exponent value.

What is the expected impact of successful exploitation?

Successful exploitation can cause a denial of service. The provided impact data indicates availability impact only, with no stated confidentiality or integrity impact.

CLEANSTART-2026-FV80975: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the denial of service?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the denial of service?

What is the expected impact of successful exploitation?