com.dtflys.forest:forest-spring (1.0.0), com.garethahealy.amq6-dual-jaas-plugin:amq6-dual-jaas-plugin-parent (>=1.2.0-beta2, <=1.4.0) +557 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.16.release)

org.springframework:spring-expression MAVEN version 3.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.dtflys.forest:forest-spring 1.0.0 -...

club.easy-utils:easy-wepay (>=0.0.1-snaoshot, <=0.0.2-snaoshot), club.easy-utils:easy-weprogram (>=0.0.1-snaoshot, <=1.0.2.1) +69 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.17.release)

org.springframework:spring-expression MAVEN version 3.2.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - club.easy-utils:easy-wepay =0.0.1-snaoshot, =0.0.1-snaoshot, =1.2, =1.0.0,...

at.molindo.social:spring-social-security (1.1.0.release), cc.fozone.validation:fo-validation (>=0.9.0.release, <=0.9.1.release) +489 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.8.release)

org.springframework:spring-expression MAVEN version 3.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-security 1.1.0.release -...

cn.smilevers:xxljob-spring-boot-starter (1.8.2-release), com.alibaba.csb.sdk:java (1.1.5.11) +153 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.18.release)

org.springframework:spring-expression MAVEN version 3.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.smilevers:xxljob-spring-boot-starter 1.8.2-release -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), cn.ymotel:largedatabtach (>=1.0.1, <=1.0.4) +630 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.20.release)

org.springframework:spring-expression MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter 0.1.8 -...

ch.ralscha:extdirectspring (1.5.0), cn.enilu:flash-core (1.0) +136 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.1.2.release)

org.springframework:spring-expression MAVEN version 4.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.ralscha:extdirectspring 1.5.0 - cn.enilu:flash-core 1.0 -...

br.com.uol.reconf:reconf-spring (>=1.0.4, <=1.4.0), co.jirm:jirm-spring (>=0.0.1, <=0.0.8) +392 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.1.0.release)

org.springframework:spring-expression MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.uol.reconf:reconf-spring =1.0.4, =0.0.1, =1.1, =1.2, =1.1, =0.9.0,...

ca.islandora.alpaca:islandora-connector-broadcast (>=0.2.0, <=0.3.0), ca.islandora.alpaca:islandora-indexing-triplestore (0.1.0) +545 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.1.9.release)

org.springframework:spring-expression MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.alpaca:islandora-connector-broadcast =0.2.0, =1.0.0, =2.0.0-rc2,...

am.ik.blog:blog-domain (>=4.2.1, <=4.3.6), am.ik.blog:blog-mapper (>=4.4.1, <=4.5.0) +1409 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.11.release)

org.springframework:spring-expression MAVEN version 4.3.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - am.ik.blog:blog-domain =4.2.1, =4.4.1, =1.0.10, =0.2.13, =0.2.13, =0.2.13,...

at.molindo:spring-data-custom (>=0.0.1, <=0.0.2), au.com.mountain-pass:hyperstate (>=1, <=3) +851 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.2.4.release)

org.springframework:spring-expression MAVEN version 4.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo:spring-data-custom =0.0.1, =1, =4.1.final, =0.0.10, =0.0.10, =0.0....

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.12), ai.houyi:dorado (>=0.0.6, <=0.0.8) +1474 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.18.release)

org.springframework:spring-expression MAVEN version 4.3.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter =0.1.10, =0.0.6, =0.0.1...

co.paralleluniverse:comsat-spring-boot (0.3.0), co.paralleluniverse:comsat-spring-webmvc (0.3.0) +156 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.8.release)

org.springframework:spring-expression MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +19158 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (>=6.2.0, <=6.2.18)

org.springframework:spring-expression MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.9.0 and more Source cves: CVE-2026-41852 Source advisory: OSV:GHSA-9F52-RJQV-25QV...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

am.ik.blog:blog-domain (>=4.0.2, <=4.2.0), am.ik.blog:blog-mapper (>=4.0.0, <=4.4.0) +1708 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.7.release)

org.springframework:spring-expression MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - am.ik.blog:blog-domain =4.0.2, =4.0.0, =2.0.0, =1.0.3, =1.0.0, =2.4, =2.4,...

br.ufc.quixada.npi:npi-core-api (0.1.0), ch.ralscha:extdirectspring (1.5.1) +539 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.1.4.release)

org.springframework:spring-expression MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.ufc.quixada.npi:npi-core-api 0.1.0 - ch.ralscha:extdirectspring 1.5.1 -...

at.porscheinformatik.zanata:zanata-spring (>=1.0.0.release, <=1.1.0.release), ca.appsimulations:jlqninterface (>=1.0.0, <=1.1.0) +1586 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.13.release)

org.springframework:spring-expression MAVEN version 4.3.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.porscheinformatik.zanata:zanata-spring =1.0.0.release, =1.0.0, =1.0.2,...

be.rufer.swisscom.sms:api-client (1.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (0.9) +233 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.1.3.release)

org.springframework:spring-expression MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.rufer.swisscom.sms:api-client 1.0 -...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +1590 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.9.release)

org.springframework:spring-expression MAVEN version 4.3.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.1, =1.1, =1.1, =1.1, =1.1, =1.2, =1.1.1,...

Spring Framework Arbitrary Method Invocation in SpEL Expressions

A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2....