6.4Orta
CVE-2026-40985Data Binding Vulnerability in Spring Web Flow with Unified EL Parser
Açıklama
Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.
Zayıflık türü (CWE):
CWE-917
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| broadcom | spring web flow | < 2.5.2 | |
| Spring | Spring Web Flow | 4.0.0 – < 4.0.0.1, 3.0.0 – < 3.0.1.1, 2.5.0 – < 2.5.2 |
Kaynaklar ve yamalar
- https://spring.io/security/cve-2026-40985 Vendor Advisory
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:broadcom:spring_web_flow:*:*:*:*:*:*:*:*< 2.5.2cpe:2.3:a:broadcom:spring_web_flow:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.0.1.1cpe:2.3:a:broadcom:spring_web_flow:4.0.0:*:*:*:*:*:*:*