CVE-2026-47886 Overview
CVE-2026-47886 is a Denial of Service (DoS) vulnerability in the Spring Framework's Spring Expression Language (SpEL) parser. Applications that evaluate user-supplied SpEL expressions can be forced into resource exhaustion when the power operator (^) is applied to a BigDecimal or BigInteger operand with a large exponent value. The unbounded arithmetic operation consumes excessive CPU and memory, degrading or halting the affected application. The advisory covers a broad range of Spring Framework releases across the 5.x, 6.x, and 7.x branches.
Critical Impact
A remote unauthenticated attacker can submit a small SpEL expression that triggers CPU and memory exhaustion, rendering the target application unavailable.
Affected Products
- Spring Framework 7.0.0 through 7.0.8
- Spring Framework 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, and 6.0.0 through 6.0.30
- Spring Framework 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier
Discovery Timeline
- 2026-08-27 - CVE-2026-47886 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-47886
Vulnerability Analysis
Spring Expression Language is a powerful expression syntax that supports querying and manipulation of object graphs at runtime. The SpEL parser exposes the caret operator (^) as a power operator, which delegates to Java arbitrary-precision arithmetic when its operands are BigDecimal or BigInteger. Arbitrary-precision pow() operations grow the result linearly in memory relative to the exponent and consume CPU time proportional to the size of the intermediate result.
An attacker who can influence a SpEL expression can supply an operand and exponent that force the JVM to allocate very large numeric objects. A single evaluation can pin CPU cores and consume gigabytes of heap, triggering long garbage collection pauses or OutOfMemoryError. Because SpEL evaluation is synchronous on the request thread in most integrations, one malicious request can block a worker until the JVM recovers.
The issue falls under algorithmic complexity and resource exhaustion classes of Denial of Service, and does not require authentication when expression evaluation is exposed on public endpoints.
Root Cause
The root cause is missing bounds enforcement on the exponent argument passed to BigDecimal.pow() and BigInteger.pow() during SpEL power-operator evaluation. The parser accepts arbitrarily large exponent literals or references without clamping, sampling execution cost, or applying a maximum result size.
Attack Vector
Exploitation requires an application that evaluates untrusted SpEL. Common sinks include annotation-driven expression evaluation, template engines that embed SpEL, message routing filters, and admin endpoints that accept expression input. An attacker submits an expression such as one that raises a BigDecimal literal to a very large integer exponent, and the server thread executing the expression stalls while allocating the result.
No verified public exploit is listed in the enriched data. See the Spring Security Advisory CVE-2026-47886 for vendor-provided technical details.
Detection Methods for CVE-2026-47886
Indicators of Compromise
- Sudden spikes in JVM CPU utilization and heap consumption correlated with HTTP requests that contain the ^ character in expression parameters.
- Application logs showing OutOfMemoryError, long GC pauses, or thread dumps stuck in java.math.BigInteger.pow or java.math.BigDecimal.pow.
- Repeated slow or timing-out requests from the same client against endpoints that accept expressions.
Detection Strategies
- Inspect inbound HTTP parameters, headers, and message bodies that reach SpEL-evaluating endpoints for the power operator combined with large numeric literals.
- Enable JVM flight recording or async-profiler sampling on affected services and alert on hot methods matching BigInteger.pow or BigDecimal.pow.
- Correlate web access logs with application error logs to identify request patterns that precede memory pressure events.
Monitoring Recommendations
- Baseline normal CPU, heap, and request latency for Spring services and alert on sustained deviation.
- Track thread pool saturation and rejected executions on servlet containers hosting Spring applications.
- Monitor for repeated client submissions of long or unusually complex expression payloads at ingress.
How to Mitigate CVE-2026-47886
Immediate Actions Required
- Identify all applications that evaluate user-supplied SpEL, including custom code that calls SpelExpressionParser or ExpressionParser on untrusted input.
- Upgrade Spring Framework to a fixed release as listed in the Spring Security Advisory CVE-2026-47886.
- Where patching is not immediate, restrict or disable evaluation of untrusted SpEL on internet-facing endpoints.
Patch Information
The vendor fix is delivered through updated Spring Framework releases across the 5.3.x, 6.0.x, 6.1.x, 6.2.x, and 7.0.x branches. Refer to the Spring Security Advisory CVE-2026-47886 for the exact fixed versions and upgrade guidance.
Workarounds
- Validate and reject expressions that contain the ^ operator when user input is passed to SpEL.
- Enforce input length limits and numeric literal size limits before expression parsing.
- Execute SpEL evaluation on a bounded thread pool with a strict timeout so a single expression cannot exhaust request workers.
- Prefer SimpleEvaluationContext over StandardEvaluationContext and avoid exposing SpEL evaluation to unauthenticated users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
