GHSA-R5W3-XV2F-J59Q Spring Framework Algorithmic Denial of Service via SpEL Expressions

🗓️ 09 Jun 2026 06:31:58Reported by GoogleType

osv

osv🔗 osv.dev👁 4 Views

Spring Framework DoS via user-supplied SpEL expressions causing resource exhaustion during evaluation.

Reporter	Title	Published	Views	Family All 45
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-expression jar	27 Jul 202607:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41850, CVE-2026-41851, CVE-2026-41852]	27 Jul 202620:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	22 Jul 202607:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Denial of Service (Dos) attacks, and Incorrect Authorization attacks	26 Jun 202618:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Aug 202614:48	–	ibm
Chainguard	CVE-2026-41850 vulnerabilities	31 Jul 202620:22	–	cgr
Circl	CVE-2026-41850	9 Jun 202607:01	–	circl
CNNVD	VMware Spring Framework 安全漏洞	9 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41850	9 Jun 202603:51	–	cve
Cvelist	CVE-2026-41850 Spring Framework Algorithmic Denial of Service via SpEL Expressions	9 Jun 202603:51	–	cvelist

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41850
github	www.github.com/spring-projects/spring-framework
github	www.github.com/spring-projects/spring-framework/releases/tag/v6.2.19
github	www.github.com/spring-projects/spring-framework/releases/tag/v7.0.8
spring	www.spring.io/security/cve-2026-41850

31 Jul 2026 15:09Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

EPSS0.0036

spring framework spel expressions denial of service resource exhaustion user supplied