Algorithmic Denial of Service Vulnerability in Spring Framework by Pivotal Software
CVE-2026-41850

7.5HIGH

Key Information:

Vendor

Spring

Status
Spring Framework
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41850?

The Spring Framework is susceptible to an Algorithmic Denial of Service (DoS) attack through user-supplied Spring Expression Language (SpEL) expressions. Attackers can exploit this vulnerability by sending crafted expressions that lead to excessive resource usage during evaluation, resulting in slowdowns, service interruptions, or complete application unavailability. It is essential for developers using affected versions to implement appropriate security measures to mitigate this risk.

Affected Version(s)

Spring Framework 7.0.0 < 7.0.7.1

Spring Framework 6.2.0 < 6.2.18.1

Spring Framework 6.1.0 < 6.1.28

References

https://spring.io/security/cve-2026-41850

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.