This vulnerability (CVE-2026-41849) involves an integer overflow or wraparound in the SpEL evaluation logic within the Spring Framework. An attacker can supply a specially crafted SpEL expression that causes the application to consume excessive resources, leading to a denial of service condition. The affected versions are 5.3.0 through 5.3.48 of the Spring Framework. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation results in denial of service due to excessive resource consumption caused by integer overflow in SpEL evaluation. There is no impact on confidentiality or integrity reported. The vulnerability can be triggered remotely without authentication or user interaction.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates. Until a fix is provided, consider applying application-level controls to limit or sanitize SpEL expressions if feasible.