CVE-2026-40985

CVE-2026-40985 affects Spring Web Flow where configurations use the WebFlowELExpressionParser. The vulnerability arises from processing Unified EL expressions, allowing a crafted expression to influence behavior. Affected versions are Spring Web Flow 4.0.0; 3.0.0–3.0.1; and 2.5.0–2.5.1. The conne...

CVE-2026-40985 Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1...

tomcat:ELEvaluationFuzzer: Security exception in org.apache.el.parser.AstGreaterThan.getValue

Detailed Report: https://oss-fuzz.com/testcase?key=6613660306833408 Project: tomcat Fuzzing Engine: libFuzzer Fuzz Target: ELEvaluationFuzzer Job Type: libfuzzerasantomcat Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.el.parser.AstGreaterThan.getValue...

tomcat:ELEvaluationFuzzer: Security exception in org.apache.el.parser.AstGreaterThan.getValue

Detailed Report: https://oss-fuzz.com/testcase?key=5140330703618048 Project: tomcat Fuzzing Engine: libFuzzer Fuzz Target: ELEvaluationFuzzer Job Type: libfuzzerasantomcat Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.el.parser.AstGreaterThan.getValue...

tomcat:ELEvaluationFuzzer: Security exception in org.apache.el.parser.AstGreaterThan.getValue

Detailed Report: https://oss-fuzz.com/testcase?key=5080868679188480 Project: tomcat Fuzzing Engine: libFuzzer Fuzz Target: ELEvaluationFuzzer Job Type: libfuzzerasantomcat Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.el.parser.AstGreaterThan.getValue...

tomcat:ELEvaluationFuzzer: Security exception in org.apache.el.parser.AstLambdaExpression.getValue

Detailed Report: https://oss-fuzz.com/testcase?key=5393332150337536 Project: tomcat Fuzzing Engine: libFuzzer Fuzz Target: ELEvaluationFuzzer Job Type: libfuzzerasantomcat Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.el.parser.AstLambdaExpression.getVal...

The vulnerability of the ELParserTokenManager function in the Jakarta EL programming language lies in insufficient validation of input data, allowing attackers to compromise the integrity of the data.

The vulnerability of the ELParserTokenManager function in the Jakarta EL programming language is related to an incorrect definition of the reliability of EL expressions. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of data...