Description

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).

Specifically, an application is vulnerable when the following condition is met:

• The application accepts and evaluates untrusted or user-controlled SpEL expressions.

Affected Spring Products and Versions

Spring Framework:

• 5.3.0 - 5.3.48

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This issue was discovered internally.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1

History

• 2026-06-08: Initial vulnerability report published.