Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Spring Expression component can be exploited for code execution
published 8 days ago
Summary
The Spring Expression library used in several Spring Framework modules has a security weakness that could let an attacker run malicious code on your server. Updating to the TuxCare‑provided version 5.1.19.RELEASE‑tuxcare.3 fixes the problem. Apply the update to all affected Spring components as soon as possible.
What to do
- Update springframework org.springframework:spring-context to version 5.1.19.RELEASE-tuxcare.3.
- Update springframework org.springframework:spring-context-support to version 5.1.19.RELEASE-tuxcare.3.
- Update springframework org.springframework:spring-expression to version 5.1.19.RELEASE-tuxcare.3.
- Update springframework org.springframework:spring-webmvc to version 5.1.19.RELEASE-tuxcare.3.
- Update springframework org.springframework:spring-websocket to version 5.1.19.RELEASE-tuxcare.3.
- Update org.springframework:spring-expression to version 5.1.19.RELEASE-tuxcare.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | springframework | org.springframework:spring-context |
>= 5.1.19.RELEASE, < 5.1.19.RELEASE-tuxcare.3 Fix: upgrade to 5.1.19.RELEASE-tuxcare.3
|
| TuxCare:Maven | springframework | org.springframework:spring-context-support |
>= 5.1.19.RELEASE, < 5.1.19.RELEASE-tuxcare.3 Fix: upgrade to 5.1.19.RELEASE-tuxcare.3
|
| TuxCare:Maven | springframework | org.springframework:spring-expression |
>= 5.1.19.RELEASE, < 5.1.19.RELEASE-tuxcare.3 Fix: upgrade to 5.1.19.RELEASE-tuxcare.3
|
| TuxCare:Maven | springframework | org.springframework:spring-webmvc |
>= 5.1.19.RELEASE, < 5.1.19.RELEASE-tuxcare.3 Fix: upgrade to 5.1.19.RELEASE-tuxcare.3
|
| TuxCare:Maven | springframework | org.springframework:spring-websocket |
>= 5.1.19.RELEASE, < 5.1.19.RELEASE-tuxcare.3 Fix: upgrade to 5.1.19.RELEASE-tuxcare.3
|
| TuxCare:Maven | – | org.springframework:spring-expression |
>= 5.1.19.RELEASE, < 5.1.19.RELEASE-tuxcare.3 Fix: upgrade to 5.1.19.RELEASE-tuxcare.3
|
Original advisory text
TuxCare security update for org.springframework:spring-expression (1 CVE)
TuxCare rebuilt org.springframework:spring-expression to address 1 CVE. Fixed in 5.1.19.RELEASE-tuxcare.3.
Timeline
Published27 Oct 2026
Updated2 Nov 2026
First seen29 Oct 2026
Sources
CLSA-2026-1793107019 · OSV
Track software like this
Free during beta