CVE-2026-41850

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48

Description Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are susceptible to an Algorithmic Denial of Service (DoS). An attacker can provide a specially crafted expression to trigger excessive resource consumption during evaluation, resulting in application degradation or unavailability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.