CVE-2026-41849 Overview
CVE-2026-41849 is an integer overflow vulnerability [CWE-190] in the evaluation logic of the Spring Expression Language (SpEL). An attacker can submit a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS) condition on the affected application.
The flaw affects Spring Framework versions 5.3.0 through 5.3.48. Exploitation requires no authentication or user interaction and is reachable over the network wherever applications evaluate untrusted SpEL input. While confidentiality and integrity are not impacted, availability is fully compromised when the vulnerability is triggered.
Critical Impact
Unauthenticated remote attackers can exhaust application resources through crafted SpEL expressions, rendering Spring-based services unavailable.
Affected Products
- VMware Spring Framework 5.3.0 through 5.3.48
- Applications embedding affected spring-expression releases
- Downstream Spring projects relying on vulnerable SpEL evaluation logic
Discovery Timeline
- 2026-06-09 - CVE-2026-41849 published to the National Vulnerability Database (NVD)
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-41849
Vulnerability Analysis
The Spring Expression Language (SpEL) is a powerful expression language used throughout the Spring portfolio to query and manipulate object graphs at runtime. Applications frequently evaluate SpEL expressions in security rules, view templates, configuration metadata, and message routing logic.
The vulnerability resides in the SpEL evaluation pipeline, where arithmetic or sizing operations on attacker-controlled inputs overflow integer bounds. When the overflow occurs, internal counters or allocation sizes wrap, causing the evaluator to enter computation paths that consume disproportionate CPU and memory. The result is a sustained Denial of Service condition for the application thread, and in many deployments for the entire JVM.
Root Cause
The root cause is an integer overflow [CWE-190] in SpEL evaluation. Bounds checks performed on expression operands do not account for wraparound, allowing crafted numeric values or repetition counts to bypass intended limits. The downstream code then performs work proportional to the post-overflow value, leading to resource exhaustion.
Attack Vector
The attack vector is network-based and unauthenticated. Any application that accepts and evaluates SpEL expressions sourced from HTTP parameters, request bodies, headers, or other untrusted channels is reachable. An attacker submits a crafted expression containing operands that trigger the overflow during evaluation. The Spring application then enters a long-running evaluation loop, blocking request threads and degrading service availability.
No verified proof-of-concept code has been published for this issue. Refer to the Spring Security Advisory for vendor technical details.
Detection Methods for CVE-2026-41849
Indicators of Compromise
- Sudden spikes in CPU utilization on Spring application JVMs without correlated traffic increases
- HTTP requests containing unusually long, numerically dense, or deeply nested SpEL expressions
- Thread dumps showing many threads blocked inside org.springframework.expression.spel evaluation classes
- Increased request latency or thread-pool saturation on endpoints that accept expression input
Detection Strategies
- Inspect application logs for repeated timeouts or OutOfMemoryError events originating from SpEL evaluation stack frames
- Deploy Web Application Firewall (WAF) rules that flag request parameters containing SpEL syntax such as T(, #{, or large numeric literals
- Correlate JVM metrics (CPU, heap, GC pause) with inbound request patterns to identify resource exhaustion attempts
- Audit application code paths to enumerate endpoints that evaluate user-supplied SpEL
Monitoring Recommendations
- Enable thread-level CPU profiling on production Spring services and alert on long-running evaluator threads
- Monitor spring-expression package stack traces in APM tooling for anomalous execution time
- Track 5xx error rates and request queue depth on endpoints that accept dynamic expressions
How to Mitigate CVE-2026-41849
Immediate Actions Required
- Inventory all applications using spring-framework versions 5.3.0 through 5.3.48 and prioritize internet-facing services
- Upgrade spring-expression and related Spring Framework artifacts to a fixed release as listed in the vendor advisory
- Restrict or eliminate evaluation of SpEL expressions sourced from untrusted input
- Apply request size and complexity limits at the WAF or API gateway to constrain expression payloads
Patch Information
VMware has published remediation guidance in the Spring Security Advisory for CVE-2026-41849. Upgrade to the fixed Spring Framework version identified in that advisory. Verify transitive dependencies through mvn dependency:tree or gradle dependencies to ensure no vulnerable spring-expression artifact remains on the classpath.
Workarounds
- Use SimpleEvaluationContext instead of StandardEvaluationContext where feasible to limit expression capabilities
- Validate and length-limit any user input before passing it to a SpEL parser
- Deploy WAF signatures that block requests containing SpEL syntax on endpoints that do not require it
- Set JVM-level timeouts on request processing threads to bound the impact of long-running evaluations
# Configuration example
# Maven: pin spring-expression to a patched release
mvn versions:set-property -Dproperty=spring-framework.version -DnewVersion=<patched-version>
# Verify no vulnerable artifact remains
mvn dependency:tree | grep spring-expression
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
