CVE-2026-41849 — Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

CVE-2026-41849

Spring Framework Denial of Service via Integer Overflow in SpEL Expressions PUBLISHED

Description (CNA)

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS). Affected versions: Spring Framework 5.3.0 through 5.3.48.

Affected (CNA)

Vendor / product	Versions
Spring / Spring Framework	affected 5.3.0 before 5.3.49

CWE

CWE-190

References

https://spring.io/security/cve-2026-41849

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.