An attacker can craft a Spring Expression Language (SpEL) expression that causes the expression evaluator to consume excessive CPU or memory resources, resulting in a slowdown or complete unavailability of the application. This vulnerability is a classic example of CWE‑407 – Excessive Resource Consumption, and it requires only that the application accepts user‑supplied SpEL expressions for evaluation.

All Spring Framework installations running Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, or 5.3.0 through 5.3.48 are affected.

The CVSS score of 7.5 indicates a high likelihood of causing disruption if exploited. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting it is known but not yet actively exploited on a large scale. The attack vector is through user input that triggers SpEL evaluation, meaning the vulnerability can be exploited remotely by any client that can submit such expressions to the application.