Description

Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.

More precisely, an application can be vulnerable when all the following are true:

• The application accepts and evaluates untrusted or user-controlled SpEL expressions.
• The application caches parsed SpEL expressions.

When all conditions are met, an attacker can cause unbounded cache growth, resulting in memory exhaustion and a Denial of Service after a high volume of processing (typically requiring millions of evaluations, even when utilizing a single expression with dynamic inputs).

Affected Spring Products and Versions

Spring Framework:

• 7.0.0 - 7.0.7
• 6.2.0 - 6.2.18
• 6.1.0 - 6.1.27
• 5.3.0 - 5.3.48

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This issue was discovered internally.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1

History

• 2026-06-08: Initial vulnerability report published.