CVE-2026-41851

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48

Description Applications that accept user-supplied Spring Expression Language (SpEL) expressions are susceptible to a Denial of Service (DoS) attack. This occurs when the evaluation of a SpEL expression triggers unbounded cache growth, which can exhaust system resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.