This vulnerability arises from the Spring Framework's handling of user-supplied SpEL expressions. If an application evaluates such expressions without limits or throttling, it may trigger unbounded cache growth, consuming excessive resources and causing a Denial of Service condition. The affected versions span multiple major releases of Spring Framework, indicating a broad impact. The CVSS 3.1 score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability (DoS). No official fix or patch has been documented in the provided data.

Successful exploitation can cause a Denial of Service by exhausting resources through unbounded cache growth during SpEL expression evaluation. There is no impact on confidentiality or integrity reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should avoid evaluating untrusted or user-supplied SpEL expressions or implement custom limits/throttling on expression evaluation to mitigate resource exhaustion risks.