Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Spring Expression/Web packages could enable unauthorized code execution
published 2 days ago
Summary
The Spring Expression and Spring Web components have been updated because they contained flaws that could let an attacker run code on your server. TuxCare has released a new package version (6.0.15‑tuxcare.6) that fixes the problems. Apply the updated packages as soon as possible to secure your applications.
What to do
- Update springframework org.springframework:spring-expression to version 6.0.15-tuxcare.6.
- Update springframework org.springframework:spring-web to version 6.0.15-tuxcare.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | springframework | org.springframework:spring-expression |
>= 6.0.15, < 6.0.15-tuxcare.6 Fix: upgrade to 6.0.15-tuxcare.6
|
| TuxCare:Maven | springframework | org.springframework:spring-web |
>= 6.0.15, < 6.0.15-tuxcare.6 Fix: upgrade to 6.0.15-tuxcare.6
|
Original advisory text
TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 6.0.15-tuxcare.6.
Timeline
Published2 Nov 2026
Updated2 Nov 2026
First seen2 Nov 2026
Sources
CLSA-2026-1793627408 · OSV
Track software like this
Free during beta