CVE-2026-47886: Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

Q: Which applications are exposed to this issue?

Applications are exposed if they evaluate user-supplied SpEL expressions. The issue is specifically triggered when an expression uses the power operator with a BigDecimal or BigInteger operand and a large exponent.

Q: What must an attacker be able to provide to exploit it?

An attacker needs the ability to supply a SpEL expression that the application evaluates. They must be able to use the ^ operator with a BigDecimal or BigInteger value and a large exponent to cause resource exhaustion.

Q: Are applications that use SpEL only for application-controlled expressions affected?

The provided information identifies user-supplied SpEL evaluation as the exposure condition. It does not indicate that applications evaluating only application-controlled expressions are affected.

Published Aug 27, 2026

Updated

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Affected Software

1 affected component

Spring Spring Framework>=7.0.0<=7.0.8, >=6.2.0<=6.2.19, >=6.1.0<=6.1.28, >=6.0.0<=6.0.30, >=5.3.0<=5.3.49, <=5.2.25.RELEASE

Event History

Aug 27, 2026

CVE Published

via MITRE·05:21 AM

Data Sourced

via MITRE·05:21 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which applications are exposed to this issue?

Applications are exposed if they evaluate user-supplied SpEL expressions. The issue is specifically triggered when an expression uses the power operator with a BigDecimal or BigInteger operand and a large exponent.

What must an attacker be able to provide to exploit it?

An attacker needs the ability to supply a SpEL expression that the application evaluates. They must be able to use the ^ operator with a BigDecimal or BigInteger value and a large exponent to cause resource exhaustion.

Are applications that use SpEL only for application-controlled expressions affected?

The provided information identifies user-supplied SpEL evaluation as the exposure condition. It does not indicate that applications evaluating only application-controlled expressions are affected.