The Spring Framework is vulnerable to a remote, unauthenticated Denial of Service attack that can exhaust system resources through crafted SpEL expressions.

The vulnerability is an uncontrolled resource consumption issue (CWE-400) triggered when the power operator is used with BigDecimal or BigInteger operands containing large exponents. This flaw allows unauthenticated remote attackers to cause significant CPU or memory consumption, leading to service unavailability.

The vulnerability carries a CVSS score of 7.5, reflecting its high potential for service disruption. Successful exploitation results in the crash or degradation of applications relying on the Spring Framework, causing immediate operational downtime and potential loss of business continuity.

Immediate Action: Review the official Spring security advisory for available patches and apply updates to the latest stable release for your specific branch.

Proactive Monitoring: Monitor application logs and server resource metrics for sudden, sustained spikes in CPU or memory usage that correlate with incoming web requests.

Compensating Controls: Implement input validation to restrict or sanitize user-supplied SpEL expressions and deploy a Web Application Firewall to block requests containing suspicious mathematical operators.

Public Exploit Available: No

Given the high impact of a Denial of Service attack, security teams should treat this vulnerability with urgency. Organizations should identify all applications utilizing the affected Spring Framework versions and prioritize the application of vendor-supplied patches to maintain system availability and resilience.