In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.

Specifically, an application is vulnerable when the following is true:

• The application evaluates user-supplied SpEL expressions.

• Spring Framework
  • 5.3.0 to 5.3.38
  • Older, unsupported versions are also affected

Users of affected versions should apply the following mitigation: 5.3.x users should upgrade to 5.3.39+ or 6.0+. Evaluation of user-supplied SpEL expressions should be avoided when possible; otherwise, user-supplied SpEL expressions should be evaluated with a SimpleEvaluationContext in read-only mode. No other steps are necessary.

Releases that have fixed this issue include:

• Spring Framework
  • 5.3.39+
  • 6.0+

This issue was identified and responsibly reported by popko.