Loading vulnerability…
Denial of Service via Integer Overflow in Spring Framework SpEL
CVE-2026-41849 is an integer overflow vulnerability in the Spring Framework Spring Expression Language (SpEL) evaluation engine. Evaluating a specially crafted attacker-controlled SpEL expression can trigger integer wraparound and excessive resource consumption, resulting in denial of service. Affected versions include Spring Framework 5.3.0 through 5.3.48; unsupported versions are also affected, although their exact ranges are unspecified. Remote exploitation is possible without authentication or user interaction when an application exposes functionality that evaluates untrusted SpEL expressions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust application resources and severely degrade or interrupt service availability. The vulnerability is rated high severity with a CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No direct confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
Prevent untrusted or user-controlled input from being parsed and evaluated as SpEL expressions. Review application data flows into SpelExpressionParser and expression-evaluation APIs, and remove or restrict exposed expression-evaluation functionality until the framework is upgraded. Switching to SimpleEvaluationContext alone does not fully mitigate this availability vulnerability.
Patch, then assume compromise.
Upgrade affected Spring Framework 5.3.x deployments to version 5.3.49, available through Tanzu Spring Enterprise commercial support, or migrate to an unaffected supported release. Spring Framework 6.2.19 and 7.0.8 are identified as unaffected migration targets. No additional vulnerability-specific mitigation is required after upgrading.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.