ch.ralscha:extdirectspring (>=1.0.0, <=1.0.1), com.enigmastation:ci-bayes (2.0.0.release) +296 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.0.3.release)

org.springframework:spring-expression MAVEN version 3.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.ralscha:extdirectspring =1.0.0, =4.0.0, =22.0.2-beta, =1.0.0-beta-1, =3.0....

at.molindo:molindo-notify (>=1.0.0-alpha-1, <=1.0.0-alpha-2), ca.grimoire.spring:spring-request-aware (1.0) +232 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.0.4.release)

org.springframework:spring-expression MAVEN version 3.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo:molindo-notify =1.0.0-alpha-1, =1.0.2, =1.1.1, =1.0.3, =1.0.1,...

br.com.ideotech:draw-out-spring-boot-aop (>=1.5.19.release, <=1.5.19-4.release), br.com.ideotech:draw-out-spring-boot-lib (>=1.5.19.release, <=1.5.19-4.release) +796 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.22.release)

org.springframework:spring-expression MAVEN version 4.3.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.ideotech:draw-out-spring-boot-aop =1.5.19.release, =1.5.19.release,...

cn.bridgeli:master-slave-db-selector (>=0.0.1, <=0.0.2), com.avanza.astrix:astrix-spring (>=0.38.1, <=0.43.6) +195 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.1.1.release)

org.springframework:spring-expression MAVEN version 4.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.bridgeli:master-slave-db-selector =0.0.1, =0.38.1, =0.14.0, =0.14.0,...

cn.deepbit:deepbit-sdk (8.3.7), cn.deepbit:deepbit-start-mvc (8.3.7) +501 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.23.release)

org.springframework:spring-expression MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.deepbit:deepbit-sdk 8.3.7 - cn.deepbit:deepbit-start-mvc 8.3.7 -...

com.alibaba.citrus:citrus-springext-all (>=3.1.6, <=3.2.4), com.alibaba.citrus:citrus-test-all (>=3.1.6, <=3.2.4) +62 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.7.release)

org.springframework:spring-expression MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.alibaba.citrus:citrus-springext-all =3.1.6, =3.1.6, =3.1.6, =0.10.0,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +166 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.0.release)

org.springframework:spring-expression MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ar.com.onready:spring-resttemplate-logger (1.0.2), br.com.ledgertec:rap-conector-client (>=0.9.0-1, <=1.0.0) +261 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.0.release)

org.springframework:spring-expression MAVEN version 4.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.onready:spring-resttemplate-logger 1.0.2 -...

at.chrl:chrl-jms (1.1.0), at.chrl:chrl-orm-spring-integration (1.1.0) +388 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.2.1.release)

org.springframework:spring-expression MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.chrl:chrl-jms 1.1.0 - at.chrl:chrl-orm-spring-integration 1.1.0 -...

GHSA-9F52-RJQV-25QV Spring Framework Arbitrary Method Invocation in SpEL Expressions

A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2....

com.bytebybyte:google-geocoding (>=3.0.0, <=3.0.1), com.bytebybyte:mapquest-open-geocoding (1.0.0) +260 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.7.release)

org.springframework:spring-expression MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.bytebybyte:google-geocoding =3.0.0, =3.0.1 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=0.4, <=0.5), com.coherentlogic.coherent.data-model:data-model-core (>=1.0.13-release, <=1.0.14-release) +89 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.1.release)

org.springframework:spring-expression MAVEN version 4.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay =0.4, =1.0.13-release,...

cn.weforward:weforward-data-mysql (>=1.1.0, <=1.2.17), com.alibaba.otter:canal.client (>=1.0.25, <=1.1.0) +345 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.9.release)

org.springframework:spring-expression MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.weforward:weforward-data-mysql =1.1.0, =1.0.25, =1.0.25, =1.0.25, =1.0.25,...

com.allanditzel:spring-security-csrf-token-filter (1.1), com.cedarsoftware:json-command-servlet (>=1.0.0, <=1.1.2) +179 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.6.release)

org.springframework:spring-expression MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.allanditzel:spring-security-csrf-token-filter 1.1 -...

com.github.dalet-oss:mongobee (>=1.0.1, <=1.0.4), com.github.mjeanroy:springmvc-mustache (>=0.6.0, <=1.0.0) +146 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.27.release)

org.springframework:spring-expression MAVEN version 4.3.27.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.dalet-oss:mongobee =1.0.1, =0.6.0, =0.10.0, =0.10.0, =0.10.0,...

be.jacobsvanroy:spring-sql-unit (>=0.7, <=0.8), br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2) +96 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.0.0.release)

org.springframework:spring-expression MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.jacobsvanroy:spring-sql-unit =0.7, =1.2.1, =1.2.10, =1.0.0, =1.0-27,...

ar.com.jmfsg:api-doc (>=0.0.20, <=0.0.27), be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3) +679 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.0.7.release)

org.springframework:spring-expression MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.jmfsg:api-doc =0.0.20, =0.3.3, =1.0.14, =1.0, =3.0.10, =3.0.10, =3.0.1...

br.com.anteros:anteros-spring-swagger (1.0.0), club.javafamily:javafamily-rest (>=0.1.0.release, <=0.1.1.release) +379 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.9.release)

org.springframework:spring-expression MAVEN version 4.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.anteros:anteros-spring-swagger 1.0.0 - club.javafamily:javafamily-rest...

ca.islandora.indexing:islandora-indexing-triplestore (>=0.0.1, <=0.0.2), com.alibaba.compileflow:compileflow (>=1.0.0-rc1, <=1.2.0) +316 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.11.release)

org.springframework:spring-expression MAVEN version 3.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.indexing:islandora-indexing-triplestore =0.0.1, =1.0.0-rc1,...