« Volver al listado

CVE-2026-47886

Estado: AnalizadaAlta (7.5)—

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N/UI:N permite explotación remota sin privilegios de aplicación web (T1190). SpEL evaluado en usuario causa DoS mediante operador potencia con exponentes grandes (T1499.004, exhaustión de recursos computacionales).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Vmware — Spring Framework

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-47886",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47886",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-27T14:59:39.970725Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Framework",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "7.0.8"
            },
            {
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.2.19"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.1.28"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.0.30"
            },
            {
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom",
              "lessThanOrEqual": "5.3.49"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "5.2.25.RELEASE"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-27T06:17:19.053",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-47886",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier"
    }
  ],
  "lastModified": "2026-09-10T14:25:17.517",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30EF6490-8C00-47AA-92FD-20E4B85D2CAE",
              "versionEndExcluding": "5.2.26"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "041DE7D7-3D90-4E6F-B086-63D8E0505527",
              "versionEndExcluding": "5.3.50",
              "versionStartIncluding": "5.3.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF7734A6-972B-4AA3-B52F-4CC72AD9DAEA",
              "versionEndExcluding": "6.0.31",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E5F1411-93C7-440E-9489-8AFF4AA60784",
              "versionEndExcluding": "6.1.29",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B93122A2-48F7-4784-AE33-143DB012EC03",
              "versionEndExcluding": "6.2.20",
              "versionStartIncluding": "6.2.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CB099EC-F3CA-4AB4-AD9F-B3AE73DE5EA5",
              "versionEndExcluding": "7.0.8.1",
              "versionStartIncluding": "7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}