CVE-2026-41849: Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

June 9, 2026 (updated July 30, 2026)

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).

Affected versions: Spring Framework 5.3.0 through 5.3.48.

References

github.com/advisories/GHSA-775g-4xr8-78h8
nvd.nist.gov/vuln/detail/CVE-2026-41849
spring.io/security/cve-2026-41849

Code Behaviors & Features

Detect and mitigate CVE-2026-41849 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →