Spring Framework SpEL Integer Overflow DoS Hits 5.3.x Branch
Attack Surface Exposure · 2 sources · Updated 4mo ago · First seen Jun 8, 2026
A high-severity denial-of-service flaw, CVE-2026-41849, was disclosed in the Spring Framework SpEL evaluation engine, where an integer overflow can let a remote, unauthenticated attacker exhaust resources if a network-exposed application evaluates attacker-controlled expressions. The issue affects Spring Framework 5.3.0 through 5.3.48 and carries a CVSS 3.1 score of 7.5, with impact limited to availability.
Spring said the vulnerability applies to the 5.3.x branch and that newer releases 6.2.19 and 7.0.8 are not affected. Public open-source remediation is available in those newer branches, while the fix for 5.3.x is 5.3.49 and is available through commercial Tanzu Spring Enterprise because the 5.3 line has reached end of life; no public proof-of-concept or confirmed in-the-wild exploitation had been reported at publication time.
