CVE-2026-47886

Overview

Spring Framework is a widely used application framework for the Java platform that provides the core programming and configuration model for modern Java enterprise applications, including the Spring Expression Language (SpEL) shipped in the spring-expression module. SpEL is an expression language that supports querying and manipulating an object graph at runtime; an application parses an expression string into an Expression and evaluates it by calling getValue against an evaluation context. Among the operators SpEL supports is the power operator (^), which raises a numeric base to an exponent. When the base is a BigDecimal or BigInteger, OperatorPower delegates the computation to BigDecimal.pow(int) or BigInteger.pow(int).

A denial of service vulnerability (CVE-2026-47886) has been identified in the Spring Expression Language, which allows attackers to exhaust CPU time and JVM heap memory on an affected server by supplying an expression that raises a BigDecimal or BigInteger to a large exponent, because the power operator performs the exponentiation with no bound on the size of the result. An application is only exposed when it evaluates untrusted or user-controlled SpEL expressions and a BigDecimal or BigInteger value is reachable within the evaluation context, for example as a named context variable, a property or field somewhere in the reachable object graph, an element of a reachable collection or map, or the return value of a registered function.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

The advisory rates this vulnerability Medium severity with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, which corresponds to a base score of 5.9. The attack vector is Network because the malicious expression arrives through ordinary application input, no privileges or user interaction are required, attack complexity is High because a BigDecimal or BigInteger value must be reachable within the evaluation context, and the Availability impact is High because the oversized power operation pins a thread for an extended time and drives the process toward an out-of-memory condition until the service becomes unavailable.

This issue affects Spring Framework <=5.2.25, >=5.3.0 <=5.3.49, >=6.0.0 <=6.0.30, >=6.1.0 <=6.1.28, >=6.2.0 <=6.2.19, and >=7.0.0 <=7.0.8, including the End-of-Life 4.3.x, 5.3.x, 6.1.x, and 6.2.x lines supported by NES for Spring Framework.

Details

Module Info

• Product: Spring Framework
• Affected packages: org.springframework:spring-expression
• Affected versions: <=5.2.25, >=5.3.0 <=5.3.49, >=6.0.0 <=6.0.30, >=6.1.0 <=6.1.28, >=6.2.0 <=6.2.19, >=7.0.0 <=7.0.8
• GitHub repository: https://github.com/spring-projects/spring-framework
• Published packages: https://central.sonatype.com/artifact/org.springframework/spring-expression
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Framework nes-v4.3.40, nes-v5.3.54, nes-v6.1.30, and nes-v6.2.21
  • Spring Framework 7.0.9 (OSS)

Vulnerability Info

This Medium-severity vulnerability is found in the spring-expression package in multiple versions of Spring Framework. org.springframework.expression.spel.ast.OperatorPower implements the SpEL power operator (^). When both operands are numbers, it inspects the type of the base and, for a BigDecimal or BigInteger base, evaluates the exponentiation directly:

if (leftNumber instanceof BigDecimal) {
    BigDecimal leftBigDecimal = NumberUtils.convertNumberToTargetClass(leftNumber, BigDecimal.class);
    return new TypedValue(leftBigDecimal.pow(rightNumber.intValue()));
}
else if (leftNumber instanceof BigInteger) {
    BigInteger leftBigInteger = NumberUtils.convertNumberToTargetClass(leftNumber, BigInteger.class);
    return new TypedValue(leftBigInteger.pow(rightNumber.intValue()));
}
else if (leftNumber instanceof Double || rightNumber instanceof Double) {
    return new TypedValue(Math.pow(leftNumber.doubleValue(), rightNumber.doubleValue()));
}

The exponent is taken from the right operand with rightNumber.intValue(), so it can be any value up to Integer.MAX_VALUE, and the base can be any BigDecimal or BigInteger reachable from the expression. Neither BigDecimal.pow nor BigInteger.pow bounds the size of its result, and OperatorPower performs no check before calling them. The size of the result grows in proportion to the base's bit length multiplied by the exponent, so an expression such as #value ^ 2000000000, where #value is a modestly sized BigInteger, forces the JVM to compute and allocate a number of many gigabits. BigInteger.pow runs the entire computation before returning, which pins a worker thread for a long time and can exhaust the heap with a single request, producing an OutOfMemoryError and making the service unavailable.

Only the BigDecimal and BigInteger branches are unbounded. Bases of type Double, Float, int, or long fall through to Math.pow(double, double), whose runtime cost and result size are constant, so those types are not affected. The exposure requires an application that evaluates attacker-influenced SpEL and an evaluation context in which a BigDecimal or BigInteger value is reachable; the restricted SimpleEvaluationContext used to sandbox untrusted input does not prevent the attack, because the vulnerable value can be supplied through the context itself rather than constructed in the expression.

This vulnerability was introduced in 2013 with Spring Framework 4.0.0.RELEASE.

Mitigation

Only recent versions of Spring Framework receive community support. The 4.3.x, 5.3.x, 6.1.x, and 6.2.x lines are End-of-Life and will not receive public updates to address this issue, so there is no publicly available fix for those lines other than through a commercial support partner.

Applications that cannot upgrade immediately can reduce their exposure by not evaluating untrusted or user-controlled SpEL expressions, and, where such expressions must be evaluated, by ensuring that no BigDecimal or BigInteger value is reachable within the evaluation context handed to them, since the attack requires such a value to be present.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Framework. The open-source fix ships in Spring Framework 7.0.9 on the 7.0.x line.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, which provides the fix for the 4.3.x, 5.3.x, 6.1.x, and 6.2.x lines in 4.3.30-spring-framework-4.3.40, 5.3.39-spring-framework-5.3.54, 6.1.21-spring-framework-6.1.30, and 6.2.19-spring-framework-6.2.21.

Credits

• This issue was discovered internally by the Spring team and later reported independently by an external researcher.
• Yu Bao from PayPal Cyber Security Team (finder)