Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') (CVE-2026-40477, CVE-2026-40478)

Summary There are vulnerabilities in thymeleaf-3.1.2.RELEASE.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40477, CVE-2026-40478. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-40477 DESCRIPTION: Thymeleaf is a server-side Java template engine...

CVE-2026-40478

creationtimestamp| type| source ---|---|--- 2026-04-17 23:20:34+00:00| published-proof-of-concept| Telegram/tNtN6ajST1i0hZ4W2szdcVpxF1Em9wIkkVyc-W9Ntpka1A 2026-04-17 23:50:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjq4jah7bm26 2026-04-26 04:07:08+00:00| seen|...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +3351 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (>=m1, <=3.1.3.release)

org.thymeleaf:thymeleaf MAVEN version =m1, =0.5.0, =1.0.0, =0.9.6, =0.9.6, =1.0.0, =0.0.1, =1.0.0, =1.0, =3.4.0, =8.8.2 and more Source cves: CVE-2026-40478 Source advisory: MEND:CVE-2026-40478...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), best.skn:skn-spring-mail (>=1.0.0, <=2.4.0) +771 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf-spring6 (>=3.1.0.m1, <=3.1.3.release)

org.thymeleaf:thymeleaf-spring6 MAVEN version =3.1.0.m1, =1.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.6.0, =7.6.0, =7.0.0, =8.8.2 and more Source cves: CVE-2026-40478 Source advisory: MEND:CVE-2026-40478...

org.thymeleaf:thymeleaf-spring3 (2.0.1) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.1)

org.thymeleaf:thymeleaf MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.1 Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24), au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1) +1482 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf-spring5 (>=3.0.9.release, <=3.1.3.release)

org.thymeleaf:thymeleaf-spring5 MAVEN version =3.0.9.release, =0.5.0, =1.1.1, =3.4.0, =5.6.5, =4.1.0, =4.1.0, =3.7.0, =3.7.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =5.3.0, =3.7.0, =5.5.7 and more Source cves: CVE-2026-40478 Source advisory: SNYK:JAVA-ORGTHYMELEAF-16078378...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), best.skn:skn-spring-mail (>=1.0.0, <=2.4.0) +771 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf-spring6 (>=3.1.0.m1, <=3.1.3.release)

org.thymeleaf:thymeleaf-spring6 MAVEN version =3.1.0.m1, =1.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.6.0, =7.6.0, =7.0.0, =8.8.2 and more Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

org.thymeleaf:thymeleaf-spring3 (1.0.0) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (1.0.0)

org.thymeleaf:thymeleaf MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0 Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

org.thymeleaf:thymeleaf-spring3 (2.0.3) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.3)

org.thymeleaf:thymeleaf MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.3 Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

org.thymeleaf.extras:thymeleaf-extras-tiles2 (1.0.0-beta2), org.thymeleaf:thymeleaf-spring3 (2.0.12) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.12)

org.thymeleaf:thymeleaf MAVEN version 2.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf.extras:thymeleaf-extras-tiles2 1.0.0-beta2 - org.thymeleaf:thymeleaf-spring3 2.0.12 Source cves:...

com.github.dandelion:datatables-thymeleaf (>=0.9.0, <=0.9.2), nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect (>=1.1, <=1.1.3) +10 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.17)

org.thymeleaf:thymeleaf MAVEN version 2.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.github.dandelion:datatables-thymeleaf =0.9.0, =1.1, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga,...

org.thymeleaf:thymeleaf-spring3 (1.1.2) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (1.1.2)

org.thymeleaf:thymeleaf MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.1.2 Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), best.skn:skn-spring-mail (>=1.0.0, <=2.4.0) +771 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf-spring6 (>=3.1.0.m1, <=3.1.3.release)

org.thymeleaf:thymeleaf-spring6 MAVEN version =3.1.0.m1, =1.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.6.0, =7.6.0, =7.0.0, =8.8.2 and more Source cves: CVE-2026-40478 Source advisory: SNYK:JAVA-ORGTHYMELEAF-16078377...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), best.skn:skn-spring-mail (>=1.0.0, <=2.4.0) +771 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf-spring6 (>=3.1.0.m1, <=3.1.3.release)

org.thymeleaf:thymeleaf-spring6 MAVEN version =3.1.0.m1, =1.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.6.0, =7.6.0, =7.0.0, =8.8.2 and more Source cves: CVE-2026-40478 Source advisory: GHSA-XJW8-8C5C-9R79...

org.thymeleaf:thymeleaf-spring3 (1.1.3) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (1.1.3)

org.thymeleaf:thymeleaf MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.1.3 Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

org.thymeleaf:thymeleaf-spring3 (2.0.0-beta2) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.0-beta2)

org.thymeleaf:thymeleaf MAVEN version 2.0.0-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.0-beta2 Source cves: CVE-2026-40478 Source advisory:...

org.thymeleaf:thymeleaf-spring3 (2.0.7) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.7)

org.thymeleaf:thymeleaf MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.7 Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

org.thymeleaf:thymeleaf-spring3 (2.1.0-m3) potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.1.0-m3)

org.thymeleaf:thymeleaf MAVEN version 2.1.0-m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.1.0-m3 Source cves: CVE-2026-40478 Source advisory: OSV:GHSA-XJW8-8C5C-9R79...

com.connect-group:thymesheet (2.1.1), com.connect-group:thymesheet-spring3 (2.1.1) +7 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.1.1.release)

org.thymeleaf:thymeleaf MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.connect-group:thymesheet 2.1.1 - com.connect-group:thymesheet-spring3 2.1.1 -...

org.broadleafcommerce:broadleaf-common (>=3.0.11-ga, <=3.0.16-ga), org.broadleafcommerce:broadleaf-contentmanagement-module (>=3.0.11-ga, <=3.0.16-ga) +8 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.20)

org.thymeleaf:thymeleaf MAVEN version 2.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.broadleafcommerce:broadleaf-common =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =2.0.8, =2.0....