Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-expression jar

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41850, CVE-2026-41851 and CVE-2026-41852 reported for spring-expression-6.2.12.jar, spring-expression-6.2.18.jar . Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-expression-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

K000162130: Spring Framework vulnerability CVE-2026-41851

Security Advisory Description Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. Affected versions: Spring Framework 7.0.0 through 7.0.7;...

ch.ralscha:extdirectspring (1.2.3), ch.tatool:tatool-app (>=1.3, <=1.3.2) +244 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.1.3.release)

org.springframework:spring-expression MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.ralscha:extdirectspring 1.2.3 - ch.tatool:tatool-app =1.3, =1.3, =1.3,...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

cn.bridgeli:master-slave-db-selector (>=0.0.1, <=0.0.2), com.avanza.astrix:astrix-spring (>=0.38.1, <=0.43.6) +195 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.1.1.release)

org.springframework:spring-expression MAVEN version 4.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.bridgeli:master-slave-db-selector =0.0.1, =0.38.1, =0.14.0, =0.14.0,...

cn.smilevers:xxljob-spring-boot-starter (1.8.2-release), com.alibaba.csb.sdk:java (1.1.5.11) +153 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.2.18.release)

org.springframework:spring-expression MAVEN version 3.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.smilevers:xxljob-spring-boot-starter 1.8.2-release -...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +16435 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (>=6.1.0, <=6.1.21)

org.springframework:spring-expression MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0-beta.2 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 and more Source cves:...

at.porscheinformatik.zanata:zanata-spring (>=1.0.0.release, <=1.1.0.release), ca.appsimulations:jlqninterface (>=1.0.0, <=1.1.0) +1586 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.3.13.release)

org.springframework:spring-expression MAVEN version 4.3.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.porscheinformatik.zanata:zanata-spring =1.0.0.release, =1.0.0, =1.0.2,...

cn.wizzer.app:wk-common (>=5.1.5, <=5.2.8-zookeeper), cn.wizzer.app:wk-nb-service-cms (>=5.1.5, <=5.2.8-zookeeper) +347 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.3.21.release)

org.springframework:spring-expression MAVEN version 4.3.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.wizzer.app:wk-common =5.1.5, =5.1.5, =5.1.5, =5.1.5, =5.1.5, =5.1.5,...

biz.paluch.redis:lettuce (>=3.0.beta1, <=4.0.beta1), biz.paluch.redis:spinach (>=0.1, <=0.3) +326 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.1.4.release)

org.springframework:spring-expression MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - biz.paluch.redis:lettuce =3.0.beta1, =0.1, =1.0.0, =2.0.0-rc1, =1.5, =0.0.1,...

at.chrl:chrl-jms (1.1.0), at.chrl:chrl-orm-spring-integration (1.1.0) +388 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.2.1.release)

org.springframework:spring-expression MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.chrl:chrl-jms 1.1.0 - at.chrl:chrl-orm-spring-integration 1.1.0 -...

at.molindo.social:spring-social-config (1.1.0.release), at.molindo.social:spring-social-core (1.1.0.release) +310 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.0.3.release)

org.springframework:spring-expression MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-config 1.1.0.release -...

com.blogspot.ostas:jamaexamplewebapp (>=1.0.1, <=1.0.2), com.github.bluejoe2008:elfinder-servlet-2 (>=1.0, <=1.2) +439 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.2.3.release)

org.springframework:spring-expression MAVEN version 3.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.blogspot.ostas:jamaexamplewebapp =1.0.1, =1.0, =1.0.0, =1.0.1, =1.2.1 and...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-core (1.1.4.release) +431 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.1.8.release)

org.springframework:spring-expression MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...

ar.com.jmfsg:api-doc (>=0.0.28, <=0.0.34), ch.ralscha:extdirectspring (>=1.3.2, <=1.3.5) +241 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.2.2.release)

org.springframework:spring-expression MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.jmfsg:api-doc =0.0.28, =1.3.2, =1.0.0, =1.6.0, =2.100.0, =2.0.2, =2.0....

am.ik.home:uaa-client (>=1.3.0, <=1.8.1), am.ik.home:uaa-integration-test (>=1.3.0, <=1.8.1) +940 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.3.6.release)

org.springframework:spring-expression MAVEN version 4.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - am.ik.home:uaa-client =1.3.0, =1.3.0, =1.3.0, =0.0.1, =0.2.0, =1.0.8, =0.1,...

br.ufc.quixada.npi:npi-core-api (0.1.0), ch.ralscha:extdirectspring (1.5.1) +539 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.1.4.release)

org.springframework:spring-expression MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.ufc.quixada.npi:npi-core-api 0.1.0 - ch.ralscha:extdirectspring 1.5.1 -...

au.com.dius.pact.provider:spring (>=4.1.0, <=4.1.6), au.com.dius:pact-jvm-provider-spring (>=4.0.0-beta.1, <=4.0.10) +663 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.3.19.release)

org.springframework:spring-expression MAVEN version 4.3.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - au.com.dius.pact.provider:spring =4.1.0, =4.0.0-beta.1, =3.6.0-rc.1, =0.0.1,...

be.personify.iam:personify-api (>=1.0.2.release, <=1.0.8.release), club.trandiscuss:api-doc-gen (0.1) +806 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.3.25.release)

org.springframework:spring-expression MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.personify.iam:personify-api =1.0.2.release, =2.2.1zzlh, =2.2.1zzlh, =1.4....