CLEANSTART-2026-ED42524 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...

🗓️ 10 Sep 2026 02:46:42Reported by GoogleType

osv🔗 osv.dev👁 17 Views

DoS in spring-boot via user-supplied SpEL expressions triggering unbounded cache growth.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0	28 Sep 202613:49	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Framework affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses httpcore5-h2-5.3.4.jar which is vulnerable to CVE-2026-54428	6 Aug 202614:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-expression jar	27 Jul 202607:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Denial of Service Vulnerability in Electronic Service Agent [CVE-2026-54399]	31 Jul 202601:22	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	3 Aug 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41850, CVE-2026-41851, CVE-2026-41852]	27 Jul 202620:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DB2 Developer Extension is affected due to vulnerability in Spring boot Core (CVE-2026-41848)	17 Sep 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	12 Aug 202611:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway	15 Sep 202613:00	–	ibm

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ED42524.json
osv	www.osv.dev/vulnerability/CVE-2026-22745
osv	www.osv.dev/vulnerability/CVE-2026-41848
osv	www.osv.dev/vulnerability/CVE-2026-41851
osv	www.osv.dev/vulnerability/CVE-2026-54399
osv	www.osv.dev/vulnerability/CVE-2026-54428
osv	www.osv.dev/vulnerability/ghsa-4265-ccf5-phj5
osv	www.osv.dev/vulnerability/ghsa-4g9r-vxhx-9pgx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-22745
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41848

18 Sep 2026 12:16Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.19.8

EPSS0.0087

spring-boot SpEL expressions Denial of Service unbounded cache growth user-supplied input