6.4Media
CVE-2026-40985Data Binding Vulnerability in Spring Web Flow with Unified EL Parser
Descripción
Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.
Debilidad (CWE):
CWE-917
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| broadcom | spring web flow | < 2.5.2 | |
| Spring | Spring Web Flow | 4.0.0 – < 4.0.0.1, 3.0.0 – < 3.0.1.1, 2.5.0 – < 2.5.2 |
Referencias y parches
- https://spring.io/security/cve-2026-40985 Vendor Advisory
Coincidencias CPE (NVD) (3)
cpe:2.3:a:broadcom:spring_web_flow:*:*:*:*:*:*:*:*< 2.5.2cpe:2.3:a:broadcom:spring_web_flow:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.0.1.1cpe:2.3:a:broadcom:spring_web_flow:4.0.0:*:*:*:*:*:*:*