thymeleaf vulnerabilities (CVE)

CVE records published for thymeleaf, newest first. Follow to get an email when a new one appears.

3 results
9.1Critical
CVE-2026-40478

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

thymeleaf thymeleaf; thymeleaf org.thymeleaf:thymeleaf-spring5; thymeleaf org.thymeleaf:thymeleaf-spring6; Red Hat Red Hat OpenShift Dev Spaces 3.28

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expre…

1.1%EPSS
9.1Critical
CVE-2026-40477

Improper restriction of the scope of accessible objects in Thymeleaf expressions

thymeleaf thymeleaf; thymeleaf org.thymeleaf:thymeleaf-spring5; thymeleaf org.thymeleaf:thymeleaf-spring6; Red Hat Red Hat OpenShift Dev Spaces 3.28

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expressio…