This vulnerability (CVE-2026-41850) affects Spring Framework versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. It arises from inefficient algorithmic complexity (CWE-407) in the processing of user-supplied Spring Expression Language (SpEL) expressions. When an application evaluates these expressions, a specially crafted input can trigger excessive CPU or memory consumption, resulting in an Algorithmic Denial of Service (DoS). The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. No official patch or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation leads to denial of service by causing excessive resource consumption during SpEL expression evaluation. This results in application degradation or unavailability. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or sanitizing user input that is evaluated as SpEL expressions to reduce risk. Monitor application performance for unusual resource consumption related to expression evaluation. Avoid exposing SpEL evaluation functionality to untrusted users if possible.