CVE-2026-47886 Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

High 7.5 Published 27 Aug 2026 Updated 27 Aug 2026

Attackers can cause denial of service in applications evaluating user-supplied SpEL expressions by using large exponents with BigDecimal or BigInteger operands.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-47886?

CVE-2026-47886 is a high-severity denial of service vulnerability in Vmware Spring Framework, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Weakness: CWE-400

Which versions are affected by CVE-2026-47886?

It affects 1 product.

Products include Vmware Spring Framework.

How do I fix CVE-2026-47886?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-47886 being exploited?

There is no known exploitation of CVE-2026-47886 in the wild and no public exploit code.

All Vmware Spring Framework vulnerabilities

Sources

Also known as CLEANSTART-2026-EQ90075, CLEANSTART-2026-PE22489, CLEANSTART-2026-TO72902, CLEANSTART-2026-XM34051, CLSA-2026-1789510477, CLSA-2026-1790089505 and 5 more.