Resource exhaustion in Spring Framework - CVE-2026-47886
Published: August 28, 2026
Vulnerability identifier: #VU146218
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47886
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Spring Expression Language (SpEL) expression evaluation when processing user-supplied expressions that use the power operator with a BigDecimal or BigInteger operand and a large exponent value. A remote attacker can submit a specially crafted expression to cause a denial of service.
Exploitation requires that the application accept and evaluate untrusted SpEL expressions and that a BigDecimal or BigInteger value be accessible within the evaluation context.
Affected software
Spring Framework
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
IBM Sterling Control Center
IBM Netezza Performance Server
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
IBM Sterling Control Center
IBM Netezza Performance Server
How to mitigate CVE-2026-47886
Install security update from vendor's website.
Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
IBM Sterling Control Center - addressed in versions 6.3.1.0.12, 6.4.2.0.8
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0
IBM Netezza Performance Server - update to 11.3.1.3 IF6
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
IBM Sterling Control Center - addressed in versions 6.3.1.0.12, 6.4.2.0.8
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0
IBM Netezza Performance Server - update to 11.3.1.3 IF6