Executive brief
Spring Framework, a widely used development framework for Java applications, is vulnerable to a denial-of-service attack. An attacker can send specially crafted input to applications that process Spring Expression Language (SpEL) to exhaust system resources. This can lead to significant application slowdowns or complete service outages, impacting business operations and availability.
Technical details
The vulnerability is classified as Inefficient Algorithmic Complexity (CWE-407) within the Spring Expression Language (SpEL) component of the Spring Framework. A remote, unauthenticated attacker can exploit this by submitting a specially crafted SpEL expression that triggers worst-case resource consumption during evaluation. This leads to CPU or memory exhaustion, resulting in a Denial of Service (DoS) condition. The issue affects multiple major versions of the framework, and patches have been released in versions 7.0.8 and 6.2.19, with corresponding updates for other supported branches.
Affected products
- VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48
Timeline
- 2026-06-09: advisory: Initial disclosure and NVD publication
- 2026-07-30: other: Advisory updated in GitHub Advisory Database