HIGH 7.5
GHSA-775g-4xr8-78h8
Spring Framework Denial of Service via Integer Overflow in SpEL Expressions
Details
An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).
Affected versions: Spring Framework 5.3.0 through 5.3.48.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.springframework:spring-expression
Introduced in:
0 No fixed version published yet for org.springframework:spring-expression (maven). Pin to a known-safe version or switch to an alternative.