← Back

CVE-2026-59283

nvd nist
Published: Aug 27, 2026Modified: Sep 1, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Exploitability: 3.9 / Impact: 5.2
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Affected (6)

Vmware
1 product
Spring Framework
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Framework
Before 5.2.26
Spring Framework
From 5.3.0 to 5.3.50
Spring Framework
From 6.0.0 to 6.0.31
Spring Framework
From 6.1.0 to 6.1.29
Spring Framework
From 6.2.0 to 6.2.20
Spring Framework
From 7.0.0 to 7.0.8.1

Related CWEs

CWE-913
Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.