6.4Mittel
CVE-2026-40985Data Binding Vulnerability in Spring Web Flow with Unified EL Parser
Beschreibung
Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.
Schwachstellentyp (CWE):
CWE-917
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| broadcom | spring web flow | < 2.5.2 | |
| Spring | Spring Web Flow | 4.0.0 – < 4.0.0.1, 3.0.0 – < 3.0.1.1, 2.5.0 – < 2.5.2 |
Referenzen und Patches
- https://spring.io/security/cve-2026-40985 Vendor Advisory
CPE-Treffer (NVD) (3)
cpe:2.3:a:broadcom:spring_web_flow:*:*:*:*:*:*:*:*< 2.5.2cpe:2.3:a:broadcom:spring_web_flow:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.0.1.1cpe:2.3:a:broadcom:spring_web_flow:4.0.0:*:*:*:*:*:*:*