CVE-2026-41849: Spring Framework Denial of Service via Integer Overflow in SpEL Expressions
An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS). Affected versions: Spring Framework 5.3.0 through 5.3.48.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41849?
The severity of CVE-2026-41849 is rated high with a score of 7.5.
How do I fix CVE-2026-41849?
To fix CVE-2026-41849, upgrade to the latest version of the VMware Spring Framework that addresses the vulnerability.
What type of vulnerability is CVE-2026-41849?
CVE-2026-41849 is a denial of service vulnerability caused by an integer overflow in SpEL expressions.
What can an attacker achieve by exploiting CVE-2026-41849?
By exploiting CVE-2026-41849, an attacker can cause excessive resource consumption, leading to a denial of service.
Which software is affected by CVE-2026-41849?
CVE-2026-41849 affects the VMware Spring Framework.