thymeleaf org.thymeleaf:thymeleaf-spring5 vulnerabilities (CVE)

CVE records published for thymeleaf org.thymeleaf:thymeleaf-spring5, newest first. Follow to get an email when a new one appears.

2 results

9.1Critical

CVE-2026-40478 6 months ago

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

thymeleaf thymeleaf; thymeleaf org.thymeleaf:thymeleaf-spring5; thymeleaf org.thymeleaf:thymeleaf-spring6; Red Hat Red Hat OpenShift Dev Spaces 3.28

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expre…

1.1%EPSS

9.1Critical

CVE-2026-40477 6 months ago

Improper restriction of the scope of accessible objects in Thymeleaf expressions

thymeleaf thymeleaf; thymeleaf org.thymeleaf:thymeleaf-spring5; thymeleaf org.thymeleaf:thymeleaf-spring6; Red Hat Red Hat OpenShift Dev Spaces 3.28

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expressio…