Applications that evaluate user‑supplied Spring Expression Language (SpEL) expressions can be forced into a Denial of Service when the power operator (^) is used with a BigDecimal or BigInteger operand and a very large exponent. The size of the calculation grows exponentially, rapidly using CPU and memory resources until the host becomes unresponsive. The vulnerability does not disclose data or allow code execution, but it can render an application or service unavailable for legitimate users.

The flaw affects the Spring Framework across multiple major releases: version 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and all releases of 5.2 prior to 5.2.25.RELEASE. Systems using any of these Framework versions that accept untrusted SpEL input are vulnerable.

The CVSS score for this issue is 7.5, indicating a high severity but not critical. The EPSS score is < 1%, indicating a very low probability of public exploitation, but does not eliminate risk. The likely attack vector is remote injection through user‑supplied input; the attacker can craft a SpEL expression containing an excessively large exponent and send it to the vulnerable application over HTTP or another protocol that processes SpEL. If the application evaluates the expression, the resource exhaustion will occur on the server hosting the framework. The impact is confined to the availability of that application or service, affecting all clients relying on it.