Executive brief
The Spring Framework is a widely used software foundation for building Java-based enterprise applications. A vulnerability in its expression language component allows an attacker to send a specially crafted request that causes the server to consume excessive CPU or memory resources. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.
Technical details
An integer overflow vulnerability (CWE-190) exists within the evaluation logic of the Spring Expression Language (SpEL) in the Spring Framework. The flaw is located in the `spring-expression` module, where certain calculations during expression evaluation do not properly handle large integer values, leading to a wraparound. A remote, unauthenticated attacker can exploit this by providing a specially crafted SpEL expression that triggers an infinite loop or excessive memory allocation. This results in a Denial of Service (DoS) by exhausting system resources. The vulnerability affects versions 5.3.0 through 5.3.48; users should upgrade to a patched version (e.g., 5.3.49 or later) as recommended by the vendor.
Affected products
- VMware Spring Framework 5.3.0 through 5.3.48
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory