CVE-2026-47886

Spring Framework versions 5.2.25.RELEASE through 7.0.8 are affected by a Denial of Service (DoS) vulnerability in the Spring Expression Language (SpEL) evaluator. The root cause is unbounded exponentiation when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exp...

EUVD-2026-66854

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...