Integer Overflow Vulnerability in Spring Framework by Spring

CVE-2026-41849

What is CVE-2026-41849?

An integer overflow vulnerability has been identified in the evaluation logic of the Spring Expression Language (SpEL), which can be exploited by an attacker. By providing a carefully crafted SpEL expression, the attacker can trigger excessive resource consumption, potentially resulting in a Denial of Service (DoS). This vulnerability affects various versions of the Spring Framework, making it crucial for users to review their deployments and apply the necessary updates to mitigate the risk.

References