CVE-2026-40985 Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1...

CVE-2026-40985

CVE-2026-40985 affects Spring Web Flow where configurations use the WebFlowELExpressionParser. The vulnerability arises from processing Unified EL expressions, allowing a crafted expression to influence behavior. Affected versions are Spring Web Flow 4.0.0; 3.0.0–3.0.1; and 2.5.0–2.5.1. The conne...

The vulnerability of the ELParserTokenManager function in the Jakarta EL programming language lies in insufficient validation of input data, allowing attackers to compromise the integrity of the data.

The vulnerability of the ELParserTokenManager function in the Jakarta EL programming language is related to an incorrect definition of the reliability of EL expressions. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of data...