Executive brief
Spring Framework, a widely-used Java application framework, contains a vulnerability in its expression language (SpEL) parser. When an application allows users to supply expressions that are evaluated, an attacker can cause the application to hang or crash by using the power operator with large exponent values on decimal numbers, leading to service outages and business disruption.
Technical details
The vulnerability is a Denial of Service (DoS) in Spring Framework's Spring Expression Language (SpEL) parser. The root cause is improper handling of the power operator (^) when applied to BigDecimal or BigInteger operands with large exponent values, which causes computationally expensive operations that consume excessive resources. The attack vector is network-based and requires only that the application evaluate user-supplied SpEL expressions; no authentication is required. An unauthenticated attacker can craft a malicious expression (e.g., "1BD^999999999") to exhaust CPU and memory resources, causing the application to become unresponsive. Patches are available in Spring Framework versions 5.3.50, 6.0.31, 6.1.29, 6.2.20, and 7.0.9 or later.
Affected products
- Spring Spring Framework 5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8
Timeline
- 2026-08-27: disclosed