← CVE Intelligence

CVE-2026-40985

Data Binding Vulnerability in Spring Web Flow with Unified EL Parser PUBLISHED

Description (CNA)

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

Affected (CNA)

Vendor / productVersions
Spring / Spring Web Flowaffected 4.0.0 before 4.0.0.1; affected 3.0.0 before 3.0.1.1; affected 2.5.0 before 2.5.2

CWE

CWE-917

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.