What is the CVSS score of CVE-2026-41851?

CVE-2026-41851 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-41851?

VMware Spring Framework versions 5.3 through 7.0 contain a denial-of-service vulnerability affecting any application that evaluates user-supplied Spring Expression Language (SpEL) expressions.. A patch is available.

How to fix or mitigate CVE-2026-41851?

Within 24 hours: Identify all applications using Spring Framework versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, or 7.0.0-7.0.7 that evaluate user-supplied SpEL expressions. Within 7 days: Apply vendor patches to all identified systems (target versions 5.3.49+, 6.1.28+, 6.2.19+, 7.0.8+ or later per VMware advisory). Within 30 days: Verify patch deployment across all applications and conduct post-patch testing to confirm availability impact is mitigated.

Java CVE-2026-41851

EUVD-2026-35339 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-09 vmware

GHSA-wxpp-56q6-5pcg

Denial Of Service Java Spring Framework Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity trigger with availability-only impact (heap exhaustion); no confidentiality or integrity effect, scope unchanged, contingent on app accepting user SpEL.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 27, 2026 - 21:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 27, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 27, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Jun 27, 2026 - 21:22 NVD

MEDIUM HIGH

CVSS changed

Jun 27, 2026 - 21:22 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:22 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

282 maven packages depend on org.springframework:spring-expression (9 direct, 273 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

AnalysisAI

Denial of service in VMware's Spring Framework (versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7) lets remote attackers exhaust memory in applications that evaluate user-supplied Spring Expression Language (SpEL) expressions, where crafted expressions trigger unbounded internal cache growth. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), and the impact is availability-only (C:N/I:N/A:H). There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.01%, 2nd percentile), though CISA's SSVC framework flags the issue as automatable.