Applications that accept user-supplied Spring Expression Language (SpEL) expressions can be exposed to a denial‑of‑service condition when an evaluated expression induces unbounded growth in an internal cache. This memory exhaustion can cause the application to become slow or crash, disrupting availability for legitimate users. The weakness is a classic unbounded memory growth issue, identified as CWE‑770.

Spring Framework is affected. The vulnerable releases include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

The CVSS score of 5.3 indicates a moderate severity vulnerability. No EPSS data are available, and the vulnerability has not been listed in CISA’s KEV catalog. The likely attack vector is remote, via injection of crafted SpEL expressions provided by an external user or attacker. Exploitation requires that the application evaluate such expressions at run time, making the risk directly tied to the use of SpEL in the code base.