TI-2026-30259 Aliases CVE-2026-41849 GHSA-775g-4xr8-78h8

Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

LOW 32CWE-190Published 2026-06-09 · Updated 2026-06-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-190 and the CVSS impact.

Summary

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS). Affected versions: Spring Framework 5.3.0 through 5.3.48.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00263 18th percentileScored 2026-11-07

Fix Fixed Spring Framework (Spring): 5.3.49

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Spring Framework	5.3.0 to before 5.3.49	5.3.49	Patch available	CNA
—	org.springframework:spring-expression (Maven)	up to 5.3.39	—	No fix listed	GHSA-775g-4xr8-78h8

Spring Framework VendorVMware Affected 5.3.0 to before 5.3.49 Fixed in 5.3.49 Patch available CNA
org.springframework:spring-expression (Maven) Vendor— Affected up to 5.3.39 Fixed in — No fix listed GHSA-775g-4xr8-78h8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:spring_framework::::::::	5.3.0 to before 5.3.49	Vulnerable	VMware

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions 5.3.0 to before 5.3.49 Vulnerable ·VMware

Remediation

Fix · CNA Spring Framework (Spring) Fixed in 5.3.49

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-09
Spring Framework 5.3.49
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-30257 Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSLPriority LOW 23
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 2 products

OpenShift Developer Tools and Services
Red Hat OpenShift Dev Spaces

Timeline

2026-10-02 Threatist record created from CVE-2026-41849
2026-10-03 Alias added: GHSA-775g-4xr8-78h8

References

Advisory 2

Other 1

https://github.com/spring-projects/spring-framework

TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8

See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences