Junglewise Threat Intelligence

CVE-2026-41851: VMware Spring Framework denial of service in SpEL expression evaluation

CVE-2026-41851 · Severity: medium · CVSS 5.3 · Published 2026-06-09

Technologies: VMware Spring Framework. Vendors: VMware.

Executive brief

Spring Framework is a widely used software framework for building Java applications. A vulnerability in its expression language component allows an attacker to cause a denial-of-service condition by sending specially crafted inputs. This can lead to excessive memory consumption, potentially causing the application to slow down or crash, impacting business operations and service availability.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Spring Expression Language (SpEL) component of the Spring Framework. When an application evaluates user-provided SpEL expressions, certain inputs can trigger unbounded growth in internal caches used during evaluation. A remote, unauthenticated attacker can exploit this over the network to consume excessive system memory, leading to a Denial of Service (DoS). The issue is addressed in Spring Framework versions 7.0.8 and 6.2.19; users on older branches should update to the latest maintenance releases.

Affected products

  • VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory
  • 2026-07-30: patched: Updated advisory with patch information

References

Related threats