Log in Start free

Vulnerability · Published Aug 27, 2026 · Assigned by vmware

CVE-2026-59283Spring Framework Safety Guard Bypass via SpEL Expression Compilation

Critical 9.1

In plain English

A critical-severity security flaw in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.5%top 54.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2026-59283
Debian:13libspring-javano fix listedDEBIAN-CVE-2026-59283
Debian:14libspring-javano fix listedDEBIAN-CVE-2026-59283
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2026-59283
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2026-59283

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 7.0.0 – through 7.0.86.2.0 – through 6.2.196.1.0 – through 6.1.286.0.0 – through 6.0.305.3.0 – through 5.3.490 – through 5.2.25.RELEASE

Weakness: CWE-913 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References