Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by vmware

CVE-2026-41851Spring Framework Denial of Service via Unbounded Cache in SpEL

Medium 5.3

In plain English

A medium-severity resource allocation without limits in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 67.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2026-41851
Debian:13libspring-javano fix listedDEBIAN-CVE-2026-41851
Debian:14libspring-javano fix listedDEBIAN-CVE-2026-41851
Mavenorg.springframework:spring-expressionno fix listedGHSA-wxpp-56q6-5pcg
Mavenorg.springframework:spring-expression7.0.8GHSA-wxpp-56q6-5pcg
Mavenorg.springframework:spring-expression6.2.19GHSA-wxpp-56q6-5pcg
Mavenorg.springframework:spring-expressionno fix listedGHSA-wxpp-56q6-5pcg
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2026-41851
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2026-41851
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2026-41851

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 7.0.0 – before 7.0.7.16.2.0 – before 6.2.18.16.1.0 – before 6.1.285.3.0 – before 5.3.49

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References