PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41851 Spring CVE debrief

CVE-2026-41851 is a Denial of Service (DoS) vulnerability in Spring Framework. Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.

Vendor
Spring
Product
Spring Framework
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-09
Advisory published
2026-06-09
Advisory updated
2026-06-09

Who should care

Users of affected Spring Framework versions: 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Technical summary

The vulnerability has a CVSS score of 5.3 and a CVSS severity of MEDIUM. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The weakness is classified as CWE-770.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade to a non-vulnerable version of Spring Framework.
  • Implement measures to limit the growth of cache.
  • Monitor applications for unusual cache growth patterns.

Evidence notes

The CVE record was published on 2026-06-09T05:16:37.297Z and last modified on 2026-06-09T20:35:44.357Z. The vulnerability was reported by [email protected].

Official resources

CVE-2026-41851 was published on 2026-06-09T05:16:37.297Z.