Description

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T06:17:19.053Z",
  "pubdate": "2026-08-27T06:17:19.053Z",
  "executiveSummary": "This vulnerability involves a Denial of Service (DoS) condition within the Spring Expression Language (SpEL) parser. It affects applications that allow the evaluation of user-supplied expressions.\nThe flaw stems from the improper handling of the power operator (^) when applied to BigDecimal or BigInteger operands in conjunction with exceptionally large exponent values.\nBy submitting a crafted SpEL expression containing these operands and a high-magnitude exponent, an attacker can trigger uncontrolled resource consumption.\nThis leads to excessive CPU and memory usage, potentially causing the application to become unresponsive or crash, thereby denying service to legitimate users.\nAffected products include Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.\nExploitation requires no special privileges beyond the ability to influence or supply an expression string to the vulnerable SpEL evaluator. The risk is high for any application that does not strictly sanitize or restrict input expressions.",
  "technicalDetails": "The vulnerability resides within the SpEL implementation responsible for arithmetic operation processing. When the power operator (^) is invoked, the underlying SpEL engine attempts to perform exponentiation on objects identified as BigDecimal or BigInteger.\nThe root cause is an inefficient computational path when processing large exponents. Specifically, when a BigInteger or BigDecimal is raised to an extreme power, the internal library methods utilized by SpEL can trigger an exponential growth in the number of digits or bits required to represent the resulting value. This computation is computationally expensive and is not guarded against resource constraints within the evaluation logic.\nAttack Flow: 1. An attacker identifies an application entry point that passes user-provided input into a SpEL 'ExpressionParser.parseExpression()' method. 2. The attacker constructs a malicious expression string, such as 'T(java.math.BigDecimal).valueOf(2).pow(999999999)' or a variant using the ^ operator. 3. Upon evaluation, the SpEL engine processes the expression. 4. The underlying Java BigInteger/BigDecimal math libraries attempt to calculate the resulting value. 5. The operation consumes substantial CPU cycles to perform the large-scale calculation and requires significant memory to allocate the resulting object. 6. Repeated requests or a single, sufficiently large input can lead to thread starvation, CPU exhaustion, or an 'OutOfMemoryError', causing the application process to stall or terminate.\nThis vulnerability is particularly dangerous because it does not require authentication or elevated privileges, provided the application allows untrusted users to influence the expressions evaluated by the SpEL engine. The impact is primarily a Denial of Service, which effectively disrupts the availability of the vulnerable application component. Because the calculation occurs synchronously within the request processing thread, the impact is immediate and impacts the availability of the servlet or worker thread handling the request.\nThe issue is pervasive across various Spring Framework release lines, indicating a long-standing behavior in the handling of arbitrary-precision arithmetic within SpEL. The vulnerability persists across all listed versions, including the latest minor releases for 6.x and 5.x branches, until appropriate bounds checking or limits on exponent magnitude are implemented in the parser."
}