CVE-2026-59283

🗓️ 27 Aug 2026 17:57:40Reported by vmwareType

Spring Framework SpEL compiler bypasses SimpleEvaluationContext safety guard in versions 5.2-7.0.

Reporter	Title	Published	Views	Family All 139
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.1	14 Oct 202614:51	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)	23 Oct 202606:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in jackson-databind (CVE-2026-59283)	21 Oct 202620:03	–	ibm
IBM Security Bulletins	Security Bulletin: Spring Expression Language (SpEL) in IBM Sterling Control Center makes it vulnerable to Improper Control of Dynamically-Managed Code Resources (CVE-2026-59283)	13 Oct 202613:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages for Cloud Pak for Data is Vulnerable to Multiple Spring Framework Vulnerabilities.	22 Oct 202606:32	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	4 Nov 202617:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumptions in Spring Framework (CVE-2026-47886, CVE-2026-59283)	22 Oct 202620:05	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in Spring package used by IBM Netezza Appliance	12 Oct 202608:16	–	ibm
Circl	CVE-2026-59283	28 Aug 202619:50	–	circl
Cvelist	CVE-2026-59283 Spring Framework Safety Guard Bypass via SpEL Expression Compilation	27 Aug 202617:57	–	cvelist

NVD

Vulners

Node

vmware spring_frameworkRange<5.2.26

vmware spring_frameworkRange5.3.0–5.3.50

vmware spring_frameworkRange6.0.0–6.0.31

vmware spring_frameworkRange6.1.0–6.1.29

vmware spring_frameworkRange6.2.0–6.2.20

vmware spring_frameworkRange7.0.0–7.0.8.1

[
  {
    "vendor": "Spring",
    "product": "Spring Framework",
    "versions": [
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.19",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.1.0",
        "lessThanOrEqual": "6.1.28",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.30",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.3.0",
        "lessThanOrEqual": "5.3.49",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "5.2.25.RELEASE",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
spring	www.spring.io/security/cve-2026-59283

01 Sep 2026 13:57Current

6.5Medium risk

Vulners AI Score6.5

EPSS0.00546