CVE-2026-41849: Spring Framework Denial of Service via Integer Overflow in SpEL Expressions
An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).
Affected versions: Spring Framework 5.3.0 through 5.3.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
spring-frameworkfrom your environment.Remove or avoid deploying Spring Framework versions 5.3.0 through 5.3.48 until a fixed release is available. Uninstall affected versions from affected systems or revert to a non-affected distribution.
- Configuration
Disable evaluation of SpEL expressions where not required. Configure application components to reject or not evaluate user-supplied SpEL expressions to prevent exploitation via crafted expressions.
Spring Expression Language (SpEL) expression_evaluation = disabled - Compensating control
Apply input validation and filtering or deploy WAF/application-layer protections to block or sanitize untrusted SpEL expressions at the application boundary. Restrict sources that may submit SpEL expressions and monitor for excessive resource consumption indicative of exploitation attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41849?
The severity of CVE-2026-41849 is rated high with a score of 7.5.
How do I fix CVE-2026-41849?
To fix CVE-2026-41849, upgrade to the latest version of the VMware Spring Framework that addresses the vulnerability.
What type of vulnerability is CVE-2026-41849?
CVE-2026-41849 is a denial of service vulnerability caused by an integer overflow in SpEL expressions.
What can an attacker achieve by exploiting CVE-2026-41849?
By exploiting CVE-2026-41849, an attacker can cause excessive resource consumption, leading to a denial of service.
Which software is affected by CVE-2026-41849?
CVE-2026-41849 affects the VMware Spring Framework.