CVE-2026-41850: Spring Framework Algorithmic Denial of Service via SpEL Expressions

Synopsis

This is an algorithmic denial-of-service vulnerability in Spring Framework affecting applications that evaluate user-supplied Spring Expression Language (SpEL) expressions. The vulnerability is reachable over the network with no authentication required, and the CVSS vector confirms that no user interaction is needed. Successful exploitation causes excessive CPU or memory consumption during SpEL evaluation, degrading or crashing the affected application. Patched-image rebuilds at versions 5.3.49, 6.1.28, 6.2.19, and 7.0.8 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application over the network; any internet- or intranet-exposed endpoint that processes user-supplied SpEL expressions is in scope.

• AuthenticationNot required

  No credentials or session token are needed; the attacker can submit a crafted expression as an unauthenticated request.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the application without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or knowledge of the target environment beyond the exposed endpoint.

Blast Radius

• The affected service exhausts CPU or memory during SpEL expression evaluation, causing severe response-time degradation or a full application crash.
• Repeated or sustained requests amplify resource exhaustion, potentially taking the service offline for all legitimate users.
• Container restarts triggered by the crash loop can cascade to dependent services if readiness probes or circuit breakers are not configured.