AIKIDO-2026-445269
spring-expression is vulnerable to Denial of Service (DoS)
59
Medium Risk
This Affects:
spring-expressionTL;DR
spring-expression evaluates the power operator (^) on BigDecimal and BigInteger without bounding the exponent. Untrusted SpEL with a large exponent can consume CPU and heap until the application becomes unavailable. The application is only affected if it evaluates untrusted expressions and a big-number value is reachable in the context. The patch rejects unbounded exponentiation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the application evaluates untrusted SpEL expressions with a BigDecimal or BigInteger in the evaluation context.
Background info
spring-expression is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 7.0.8.
How to fix this
Upgrade the org.springframework:spring-expression library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant