club.easy-utils:easy-wepay (>=0.0.1-snaoshot, <=0.0.2-snaoshot), club.easy-utils:easy-weprogram (>=0.0.1-snaoshot, <=1.0.2.1) +69 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.17.release)

org.springframework:spring-expression MAVEN version 3.2.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - club.easy-utils:easy-wepay =0.0.1-snaoshot, =0.0.1-snaoshot, =1.2, =1.0.0,...

at.molindo.social:spring-social-security (1.1.0.release), cc.fozone.validation:fo-validation (>=0.9.0.release, <=0.9.1.release) +489 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.8.release)

org.springframework:spring-expression MAVEN version 3.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-security 1.1.0.release -...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +16435 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (>=6.1.0, <=6.1.21)

org.springframework:spring-expression MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0-beta.2 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 and more Source cves:...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

at.molindo:spring-data-custom (0.1.0), be.looorent:jflu-producer-springmvc (>=0.1, <=0.13.6) +1117 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.4.release)

org.springframework:spring-expression MAVEN version 4.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo:spring-data-custom 0.1.0 - be.looorent:jflu-producer-springmvc =0....

au.com.mountain-pass:hyperstate (>=4, <=9), be.nille.jwt:jwt-aspect (1.0.0) +970 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.2.6.release)

org.springframework:spring-expression MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - au.com.mountain-pass:hyperstate =4, =0.0.21, =0.0.21, =0.0.21, =0.0.21,...

ar.com.jmfsg:api-doc (>=0.0.28, <=0.0.34), ch.ralscha:extdirectspring (>=1.3.2, <=1.3.5) +241 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.2.release)

org.springframework:spring-expression MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.jmfsg:api-doc =0.0.28, =1.3.2, =1.0.0, =1.6.0, =2.100.0, =2.0.2, =2.0....

com.dtflys.forest:forest-spring (1.0.0), com.garethahealy.amq6-dual-jaas-plugin:amq6-dual-jaas-plugin-parent (>=1.2.0-beta2, <=1.4.0) +557 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.16.release)

org.springframework:spring-expression MAVEN version 3.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.dtflys.forest:forest-spring 1.0.0 -...

ch.rasc:sse-eventbus (1.1.9), com.atlassian.oai:swagger-request-validator-examples (>=2.9.1, <=2.13.0) +479 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.26.release)

org.springframework:spring-expression MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.rasc:sse-eventbus 1.1.9 -...

br.com.anteros:anteros-jsondoc-springboot (1.0.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.5) +1188 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.2.5.release)

org.springframework:spring-expression MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.anteros:anteros-jsondoc-springboot 1.0.0 -...

ba.jamax.util:jamax-rest (>=1.3.1-release, <=1.3.4-release), be.dnsbelgium:rdap-server (1.1.0) +1133 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.1.6.release)

org.springframework:spring-expression MAVEN version 4.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ba.jamax.util:jamax-rest =1.3.1-release, =0.0.6, =1.0.0, =0.1.0, =0.1.5,...

ca.islandora.indexing:islandora-indexing-triplestore (>=0.0.1, <=0.0.2), com.alibaba.compileflow:compileflow (>=1.0.0-rc1, <=1.2.0) +316 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.11.release)

org.springframework:spring-expression MAVEN version 3.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.indexing:islandora-indexing-triplestore =0.0.1, =1.0.0-rc1,...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-core (1.1.4.release) +431 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.1.8.release)

org.springframework:spring-expression MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +19133 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (>=6.2.0, <=6.2.18)

org.springframework:spring-expression MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.9.0 and more Source cves: CVE-2026-41852 Source advisory: GHSA-9F52-RJQV-25QV...

br.com.tecsinapse:glimpse-server (>=1.1.1, <=1.1.2), com.alexkasko.springjdbc.typedqueries:typed-queries-codegen (>=1.0, <=1.4.4) +89 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.0.2.release)

org.springframework:spring-expression MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.tecsinapse:glimpse-server =1.1.1, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0.0...

ch.epfl.bbp.nlp:bluima_abbreviations (>=1.0.0, <=1.0.1), ch.epfl.bbp.nlp:bluima_corpora (>=1.0.0, <=1.0.1) +732 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.1.2.release)

org.springframework:spring-expression MAVEN version 3.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.epfl.bbp.nlp:bluimaabbreviations =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0,...

at.molindo:molindo-notify (>=1.0.0-alpha-3, <=2.0.0), com.blitline:blitline-image-client-example (>=0.10.1, <=0.13.3) +86 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.4.release)

org.springframework:spring-expression MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo:molindo-notify =1.0.0-alpha-3, =0.10.1, =0.10.1, =1.0.0, =1.0.0,...

co.fingerprintsoft:notification-spring-boot-autoconfigure (1.0.10), co.fingerprintsoft:notification-spring-boot-starter (1.0.10) +320 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.2.8.release)

org.springframework:spring-expression MAVEN version 4.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - co.fingerprintsoft:notification-spring-boot-autoconfigure 1.0.10 -...

Spring Framework Arbitrary Method Invocation in SpEL Expressions

A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2....

GHSA-9F52-RJQV-25QV Spring Framework Arbitrary Method Invocation in SpEL Expressions

A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2....