diff --git a/spring-expression/src/main/java/org/springframework/expression/spel/SpelMessage.java b/spring-expression/src/main/java/org/springframework/expression/spel/SpelMessage.java
index b181cda36d..d9735071d1 100644
--- a/spring-expression/src/main/java/org/springframework/expression/spel/SpelMessage.java
+++ b/spring-expression/src/main/java/org/springframework/expression/spel/SpelMessage.java
@@ -284,7 +284,11 @@ public enum SpelMessage {
 
 	/** @since 5.2.24 */
 	VARIABLE_ASSIGNMENT_NOT_SUPPORTED(Kind.ERROR, 1080,
-			"Assignment to variable ''{0}'' is not supported");
+			"Assignment to variable ''{0}'' is not supported"),
+
+	/** @since 6.0.13 */
+	NEGATIVE_REPEATED_TEXT_COUNT(Kind.ERROR, 1081,
+			"Repeat count ''{0}'' must not be negative");
 
 
 	private final Kind kind;
diff --git a/spring-expression/src/main/java/org/springframework/expression/spel/ast/OpMultiply.java b/spring-expression/src/main/java/org/springframework/expression/spel/ast/OpMultiply.java
index 559a55817f..fce5a8951a 100644
--- a/spring-expression/src/main/java/org/springframework/expression/spel/ast/OpMultiply.java
+++ b/spring-expression/src/main/java/org/springframework/expression/spel/ast/OpMultiply.java
@@ -123,6 +123,10 @@ public class OpMultiply extends Operator {
 	}
 
 	private void checkRepeatedTextSize(String text, int count) {
+		if (count < 0) {
+			throw new SpelEvaluationException(getStartPosition(),
+					SpelMessage.NEGATIVE_REPEATED_TEXT_COUNT, count);
+		}
 		int result = text.length() * count;
 		if (result < 0 || result > MAX_REPEATED_TEXT_SIZE) {
 			throw new SpelEvaluationException(getStartPosition(),
diff --git a/spring-expression/src/test/java/org/springframework/expression/spel/OperatorTests.java b/spring-expression/src/test/java/org/springframework/expression/spel/OperatorTests.java
index cbbb153c9b..cb66885d8c 100644
--- a/spring-expression/src/test/java/org/springframework/expression/spel/OperatorTests.java
+++ b/spring-expression/src/test/java/org/springframework/expression/spel/OperatorTests.java
@@ -28,6 +28,7 @@ import org.springframework.expression.spel.standard.SpelExpression;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.springframework.expression.spel.SpelMessage.MAX_CONCATENATED_STRING_LENGTH_EXCEEDED;
 import static org.springframework.expression.spel.SpelMessage.MAX_REPEATED_TEXT_SIZE_EXCEEDED;
+import static org.springframework.expression.spel.SpelMessage.NEGATIVE_REPEATED_TEXT_COUNT;
 
 /**
  * Tests the evaluation of expressions using various operators.
@@ -587,6 +588,13 @@ class OperatorTests extends AbstractExpressionTests {
 		evaluateAndCheckError("'ab' * " + repeatCount, String.class, MAX_REPEATED_TEXT_SIZE_EXCEEDED, 5);
 	}
 
+	@Test
+	void stringRepeatWithNegativeRepeatCount() {
+		// 4 is the position of the '*' (repeat operator)
+		// -1 is the negative repeat count
+		evaluateAndCheckError("'a' * -1", String.class, NEGATIVE_REPEATED_TEXT_COUNT, 4, -1);
+	}
+
 	@Test
 	void stringConcatenation() {
 		evaluate("'' + ''", "", String.class);