CVE-2026-41849: Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

Synopsis

An integer overflow vulnerability exists in the Spring Expression Language (SpEL) evaluation logic within Spring Framework versions 5.3.0 through 5.3.48. The flaw is reachable over the network with no authentication required, making any internet-exposed application that evaluates user-supplied SpEL expressions a target. Successful exploitation causes excessive resource consumption, crashing or hanging the affected service and producing a denial of service. A patched-image rebuild at Spring Framework 5.3.49 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable SpEL evaluation endpoint must be reachable over the network; any internet- or intranet-exposed application accepting SpEL input is in scope.

• AuthenticationNot required

  No credentials or session token are needed; an anonymous request carrying a crafted SpEL expression is sufficient to trigger the overflow.

• Victim interactionNot required

  No action from a user or administrator is required; the attacker sends the payload directly to the service.

• Attack complexityDetail

  Exploit complexity is low; the attack is reliable and requires no specific race conditions, memory layout knowledge, or environmental pre-conditions.

Blast Radius

• Crashes or hangs the Spring application process, making the service unavailable to legitimate users.
• Sustained requests with crafted expressions can exhaust CPU or memory on the host, potentially destabilizing co-located services in the same container or pod.
• No confidential data is read and no stored data is modified; impact is limited entirely to availability.