What is the CVSS score of EUVD-2026-35337?

EUVD-2026-35337 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Framework are affected by EUVD-2026-35337?

Spring Framework versions 5.3.0 through 5.3.48 are vulnerable to remote denial-of-service attacks that can exhaust server resources and disrupt application availability.. A patch is available.

How to fix or mitigate EUVD-2026-35337?

Within 24 hours: Identify all applications and systems running Spring Framework 5.3.0-5.3.48 using software asset management and dependency scanning tools. Within 7 days: Evaluate upgrade requirements and test migration to Spring Framework 5.4.0 or later; document compatibility blockers. Within 30 days: Execute upgrade to patched Spring Framework version or implement interim controls if upgrade timeline extends beyond 30 days.

Spring Framework EUVD-2026-35337

| CVE-2026-41849 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-06-09 vmware

GHSA-775g-4xr8-78h8

Denial Of Service Java Integer Overflow Spring Framework Red Hat

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.9 HIGH

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:07 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,445 maven packages depend on org.springframework:spring-expression (71 direct, 1,375 indirect)

Ecosystem-wide dependent count for version 5.3.39.

DescriptionCVE.org

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).

Affected versions: Spring Framework 5.3.0 through 5.3.48.

Articles & Coverage 1

News 9 New Java Vulnerabilities - 1 Critical, 8 High Severity Jun 10, 2026

AnalysisAI

Denial of service in Spring Framework 5.3.0 through 5.3.48 allows remote unauthenticated attackers to exhaust server resources by submitting crafted Spring Expression Language (SpEL) expressions that trigger an integer overflow during evaluation. The CVSS 7.5 score reflects high availability impact with no confidentiality or integrity loss, and no public exploit identified at time of analysis. Applications that evaluate untrusted SpEL input are at greatest risk.

Technical ContextAI

Spring Expression Language (SpEL) is the embedded expression engine in the Spring Framework used for querying and manipulating object graphs at runtime, commonly invoked in annotations such as @Value, security expressions, data binding, and templated configuration. The flaw is classified as CWE-190 (Integer Overflow or Wraparound) inside the SpEL evaluation logic, where arithmetic on attacker-controlled values wraps past native integer bounds and drives downstream loops or allocations into excessive CPU or memory consumption. The CPE cpe:2.3:a:spring:spring_framework:*:*:*:*:*:*:*:* confirms the issue is in the core spring-framework artifact rather than a specific subproject like Spring Boot or Spring Security.

RemediationAI

Patch availability is not explicitly stated in the provided input - refer to the vendor advisory at https://spring.io/security/cve-2026-41849 for the fixed 5.3.x maintenance release and any 6.x guidance, and upgrade spring-core/spring-expression to the listed version. As compensating controls when an immediate upgrade is not possible, never pass untrusted input directly into SpEL evaluation: avoid building SpEL expressions from request parameters, JSON bodies, or templated user content; use a SimpleEvaluationContext rather than StandardEvaluationContext to constrain expression capabilities; and add a length/complexity cap on any expression strings before evaluation to limit resource consumption. Trade-offs: SimpleEvaluationContext blocks property writes and method invocation, which may break features that rely on dynamic invocation, and input length limits may reject legitimate complex expressions in rule-engine use cases.