GHSA-775g-4xr8-78h8

    Dashboard / Vulnerabilities / GHSA-775g-4xr8-78h8

    GHSA-775g-4xr8-78h8

    Published: 9 Jun 2026Last Modified: 30 Jul 2026

    Summary: Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

    Details: An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS). Affected versions: Spring Framework 5.3.0 through 5.3.48.

    References: https://nvd.nist.gov/vuln/detail/CVE-2026-41849, https://github.com/spring-projects/spring-framework, https://spring.io/security/cve-2026-41849

    Affected packages

    Package

    Name: org.springframework:spring-expression

    Purl: pkg:maven/org.springframework/spring-expression

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    3.0.0.RELEASE
    3.0.1.RELEASE
    3.0.2.RELEASE
    3.0.3.RELEASE
    3.0.4.RELEASE
    3.0.5.RELEASE
    3.0.6.RELEASE
    3.0.7.RELEASE

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-775g-4xr8-78h8 | CVE-DB