Is CVE-2026-41850 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41850 being exploited in the wild.

How severe is CVE-2026-41850?

High severity, with a CVSS score of 7.5, published 9 June 2026.

Which products and versions are affected?

org.springframework:spring-expression (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48.

Is there a fix for CVE-2026-41850?

Yes. org.springframework:spring-expression (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41850 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41850?

Check whether you run org.springframework:spring-expression (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41850: VMware Spring Framework Algorithmic DoS in SpEL evaluation

CVE-2026-41850 · Severity: high · CVSS 7.5 · Published 2026-06-09

Spring Framework, a widely used development framework for Java applications, is vulnerable to a denial-of-service attack. An attacker can send specially crafted input to applications that process Spring Expression Language (SpEL) to exhaust system resources. This can lead to significant application slowdowns or complete service outages, impacting business operations and availability.

Technologies: org.springframework:spring-expression (Maven), VMware Spring Framework. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41850 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41850 being exploited in the wild.
How severe is CVE-2026-41850?: High severity, with a CVSS score of 7.5, published 9 June 2026.
Which products and versions are affected?: org.springframework:spring-expression (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48.
Is there a fix for CVE-2026-41850?: Yes. org.springframework:spring-expression (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41850 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41850?: Check whether you run org.springframework:spring-expression (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework:spring-expression (Maven): upgrade to 7.0.8 or later

# set org.springframework:spring-expression to 7.0.8 in your pom.xml or build.gradle

Technical details

The vulnerability is classified as Inefficient Algorithmic Complexity (CWE-407) within the Spring Expression Language (SpEL) component of the Spring Framework. A remote, unauthenticated attacker can exploit this by submitting a specially crafted SpEL expression that triggers worst-case resource consumption during evaluation. This leads to CPU or memory exhaustion, resulting in a Denial of Service (DoS) condition. The issue affects multiple major versions of the framework, and patches have been released in versions 7.0.8 and 6.2.19, with corresponding updates for other supported branches.

Affected products

VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48

Identifiers

CVE-2026-41850
GHSA-r5w3-xv2f-j59q

Timeline

2026-06-09: advisory: Initial disclosure and NVD publication
2026-07-30: other: Advisory updated in GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.