What is the CVSS score of EUVD-2026-35338?

EUVD-2026-35338 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Framework are affected by EUVD-2026-35338?

Spring Framework applications (versions 5.3.x through 7.0.x) that evaluate user-supplied Spring Expression Language expressions are vulnerable to remote denial-of-service attacks executable without…. A patch is available.

How to fix or mitigate EUVD-2026-35338?

Within 24 hours: Inventory all Spring Framework instances across production and non-production environments; determine which applications evaluate user-controlled SpEL expressions; enable logging on expression evaluation endpoints. Within 7 days: Deploy WAF rules blocking common malicious SpEL patterns; implement rate limiting on affected endpoints; restrict SpEL evaluation contexts to trusted input only via Spring Security configuration. Within 30 days: Monitor vendor advisories for patch availability; evaluate architectural refactoring to eliminate SpEL evaluation of external input; plan migration timeline for Spring Framework versions once patched releases are published.

Spring Framework EUVD-2026-35338

| CVE-2026-41850 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-06-09 vmware

GHSA-r5w3-xv2f-j59q

Denial Of Service Java Spring Framework Red Hat

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:07 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

282 maven packages depend on org.springframework:spring-expression (9 direct, 273 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Articles & Coverage 1

News 9 New Java Vulnerabilities - 1 Critical, 8 High Severity Jun 10, 2026

AnalysisAI

Algorithmic denial of service in Spring Framework SpEL evaluation allows remote unauthenticated attackers to exhaust CPU/memory resources by submitting specially crafted Spring Expression Language expressions, degrading or crashing affected applications. Impacts Spring Framework 5.3.x through 7.0.x in any application that evaluates user-supplied SpEL. No public exploit identified at time of analysis, and the CVSS 7.5 score reflects high availability impact with no confidentiality or integrity compromise.

Technical ContextAI

Spring Expression Language (SpEL) is a powerful expression language shipped with the Spring Framework (cpe:2.3:a:spring:spring_framework) used for querying and manipulating object graphs at runtime, commonly embedded in annotations, configuration, templates, and security rules. The root cause is CWE-407 (Inefficient Algorithmic Complexity), meaning a crafted SpEL input forces the parser or evaluator into a computational path whose cost grows disproportionately with input size or structure, consuming CPU cycles and/or memory until the request thread is starved. Vulnerability arises only where an application deliberately exposes the SpEL evaluator to attacker-controlled strings - historically a frequent anti-pattern in dynamic rule engines, search filters, and templating layers built on top of Spring.

RemediationAI

Upgrade Spring Framework to a fixed maintenance release on your current branch - patch available per vendor advisory at https://spring.io/security/cve-2026-41850, with fix versions beyond 7.0.7, 6.2.18, 6.1.27, and 5.3.48 respectively; consult the advisory for the exact published patched version, as the input data does not specify it. Where immediate upgrade is not possible, the most effective compensating control is to stop evaluating user-supplied SpEL: refactor controllers, search/filter endpoints, and rule engines so attacker-controlled strings are never passed to SpelExpressionParser.parseExpression(), or replace them with a restricted templating layer (this may break features that legitimately accept dynamic expressions). If evaluation of external input is unavoidable, wrap evaluation with a SimpleEvaluationContext (read-only, restricted method access), enforce strict length and character allow-lists on expression inputs, and impose an evaluation timeout/thread budget at the call site - note that none of these fully neutralize an algorithmic-complexity bug, only reduce blast radius.