Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.

More precisely, an application can be vulnerable when all the following are true:

• The application accepts and evaluates untrusted or user-controlled SpEL expressions.
• The application caches parsed SpEL expressions.

When all conditions are met, an attacker can cause unbounded cache growth, resulting in memory exhaustion and a Denial of Service after a high volume of processing (typically requiring millions of evaluations, even when utilizing a single expression with dynamic inputs).