CVE-2026-41850 is an algorithmic complexity vulnerability in the Spring Framework's evaluation of user-supplied SpEL expressions. When applications evaluate these expressions, an attacker can craft inputs that cause the evaluation process to consume excessive CPU or memory resources, resulting in application degradation or unavailability. The affected versions include Spring Framework 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The vulnerability does not impact confidentiality or integrity but has a high impact on availability. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by triggering excessive resource consumption during SpEL expression evaluation. This leads to application performance degradation or unavailability. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to avoid evaluating untrusted or user-supplied SpEL expressions or to implement strict input validation and resource usage limits on expression evaluation to mitigate potential denial of service.