What is the CVSS score of EUVD-2026-35339?

EUVD-2026-35339 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by EUVD-2026-35339?

VMware Spring Framework versions 5.3 through 7.0 contain a denial-of-service vulnerability affecting any application that evaluates user-supplied Spring Expression Language (SpEL) expressions.. A patch is available.

How to fix or mitigate EUVD-2026-35339?

Within 24 hours: Identify all applications using Spring Framework versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, or 7.0.0-7.0.7 that evaluate user-supplied SpEL expressions. Within 7 days: Apply vendor patches to all identified systems (target versions 5.3.49+, 6.1.28+, 6.2.19+, 7.0.8+ or later per VMware advisory). Within 30 days: Verify patch deployment across all applications and conduct post-patch testing to confirm availability impact is mitigated.

Java EUVD-2026-35339

| CVE-2026-41851 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-09 vmware

GHSA-wxpp-56q6-5pcg

Denial Of Service Java Spring Red Hat Spring Framework

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity trigger with availability-only impact (heap exhaustion); no confidentiality or integrity effect, scope unchanged, contingent on app accepting user SpEL.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 27, 2026 - 21:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 27, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 27, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Jun 27, 2026 - 21:22 NVD

MEDIUM HIGH

CVSS changed

Jun 27, 2026 - 21:22 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:22 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

284 maven packages depend on org.springframework:spring-expression (9 direct, 275 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

AnalysisAI

Denial of service in VMware's Spring Framework (versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7) lets remote attackers exhaust memory in applications that evaluate user-supplied Spring Expression Language (SpEL) expressions, where crafted expressions trigger unbounded internal cache growth. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), and the impact is availability-only (C:N/I:N/A:H). There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.01%, 2nd percentile), though CISA's SSVC framework flags the issue as automatable.