Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Spring Framework may run unsafe code via SpEL expressions

CVE-2026-59283 · published 1 month ago
Summary

If your application uses Spring's SimpleEvaluationContext to process SpEL expressions and the expression compiler is turned on, an attacker could bypass safety checks and cause unintended code execution. This affects Spring Framework versions from 5.2.25 up through 7.0.8. Update to a patched Spring release or disable the SpEL compiler to protect your system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– spring spring framework <= 7.0.8
Debian:11 debian libspring-java All versions
Debian:12 debian libspring-java All versions
Debian:13 debian libspring-java All versions
Debian:14 debian libspring-java All versions
– vmware spring_framework < 5.2.26
>= 5.3.0, < 5.3.50
>= 6.0.0, < 6.0.31
>= 6.1.0, < 6.1.29
>= 6.2.0, < 6.2.20
>= 7.0.0, < 7.0.8.1
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
Original advisory text
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring...
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
References
Severity
9.1 Critical
CVSS 3.1: 9.1 (OSV)
Exploitation
EPSS <1%
Type
CWE-913Improper Control of Dynamically-Managed Code Resources
Timeline
Published27 Aug 2026
Updated27 Sep 2026
First seen27 Aug 2026
Sources
CVE-2026-59283 · NVD
CVE-2026-59283 · MITRE
DEBIAN-CVE-2026-59283 · OSV
Track software like this
Free during beta