CVE-2026-47886
Description
A flaw was found in Spring Framework. Applications that process user-supplied Spring Expression Language (SpEL) expressions are vulnerable to a Denial of Service (DoS) attack. This occurs when the power operator (^) is used with large numerical operands, leading to excessive resource consumption. A remote attacker could exploit this to make the application unresponsive.
Statement
A vulnerability was found in Spring Framework's Spring Expression Language (SpEL) engine. When evaluating untrusted SpEL expressions containing the power operator (^) with a BigDecimal or BigInteger operand and an excessively large exponent, the expression parser performs unbounded mathematical calculations. A remote, unauthenticated attacker can supply crafted SpEL queries to consume excessive CPU and memory resources, causing application thread exhaustion and resulting in a denial of service (DoS). Default container resource limits (cgroup memory and CPU quotas) constrain host-level impact, though application process unresponsiveness or crashes remain unavoidable.
Mitigation
Avoid evaluating untrusted, user-supplied Spring Expression Language (SpEL) input. Where SpEL evaluation of user input is mandatory, configure custom MethodResolvers or PropertyAccessors to sanitize expressions, or enforce strict execution timeouts and character white-listing upstream before expression parsing.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
