CVE-2026-47886: CWE-400 Uncontrolled Resource Consumption in Spring Spring Framework

This vulnerability occurs in the Spring Framework's evaluation of user-supplied SpEL expressions. Specifically, when the power operator (^) is applied to BigDecimal or BigInteger operands with a large exponent, it may cause excessive resource consumption, resulting in a denial of service condition. The affected versions include Spring Framework 5.2.25.RELEASE and earlier, 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. No official patch or remediation level is indicated in the provided data, and no known exploits in the wild have been reported.

Successful exploitation can cause denial of service by exhausting system resources when processing malicious SpEL expressions using the power operator with large exponents. There is no impact on confidentiality or integrity reported. The vulnerability is remotely exploitable without authentication and requires low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid evaluating untrusted or user-supplied SpEL expressions that use the power operator with BigDecimal or BigInteger operands and large exponents. Consider implementing input validation or limiting expression complexity as temporary mitigations.