Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-59283: Spring Framework may let unsafe code run
CVE-2026-59283 · published 2 months ago
Summary
If your application uses Spring Framework versions 5.2.25 or earlier, or any 6.x or 7.x release up to 7.0.8, an issue with the expression language compiler can let attackers bypass safety checks. This could lead to code being executed that the application should block. Update to the latest Spring Framework release or disable the SpEL expression compiler to protect your system.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | spring | spring framework | <= 7.0.8 |
| Debian:11 | debian | libspring-java | All versions |
| Debian:12 | debian | libspring-java | All versions |
| Debian:13 | debian | libspring-java | All versions |
| Debian:14 | debian | libspring-java | All versions |
| – | vmware | spring_framework |
< 5.2.26 >= 5.3.0, < 5.3.50 >= 6.0.0, < 6.0.31 >= 6.1.0, < 6.1.29 >= 6.2.0, < 6.2.20 >= 7.0.0, < 7.0.8.1 cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | libspring-java | All versions |
Original advisory text
Spring Framework Safety Guard Bypass via SpEL Expression Compilation
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
References
- https://security-tracker.debian.org/tracker/CVE-2026-59283 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-59283 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-59283 Third Party Advisory
- https://spring.io/security/cve-2026-59283 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59283... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59283 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-913Improper Control of Dynamically-Managed Code Resources
Timeline
Published27 Aug 2026
Updated15 Nov 2026
First seen27 Aug 2026
Sources
CVE-2026-59283 · NVD
CVE-2026-59283 · MITRE
DEBIAN-CVE-2026-59283 · OSV
UBUNTU-CVE-2026-59283 · OSV
CVE-2026-59283 · OSV
Track software like this
Free during beta