au.com.mountain-pass:hyperstate-cert (>=1, <=10), au.com.mountain-pass:hyperstate-client (>=1, <=10) +1188 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.2.release)

org.springframework:spring-expression MAVEN version 4.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - au.com.mountain-pass:hyperstate-cert =1, =1, =1, =1, =1, =1, =0.1, =1.0.0-rc,...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.12), ai.houyi:dorado (>=0.0.6, <=0.0.8) +1474 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.18.release)

org.springframework:spring-expression MAVEN version 4.3.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter =0.1.10, =0.0.6, =0.0.1...

at.rocklogic.kafka:object-support (>=0.2, <=1.1), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.0) +563 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.1.5.release)

org.springframework:spring-expression MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.rocklogic.kafka:object-support =0.2, =0.1.0, =1.3.5 -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), cn.ymotel:largedatabtach (>=1.0.1, <=1.0.4) +630 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.20.release)

org.springframework:spring-expression MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter 0.1.8 -...

ar.com.jmfsg:api-doc (>=0.0.20, <=0.0.27), be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3) +679 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.0.7.release)

org.springframework:spring-expression MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.jmfsg:api-doc =0.0.20, =0.3.3, =1.0.14, =1.0, =3.0.10, =3.0.10, =3.0.1...

GHSA-WXPP-56Q6-5PCG Spring Framework Denial of Service via Unbounded Cache in SpEL

Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0...

Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language SpEL. An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service DoS. Affected versions: Spring...

ch.inftec.ju:ju-dbutil-test-legacy (4.1), ch.ralscha:extdirectspring (>=1.3.0, <=1.3.1) +171 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (3.2.1.release)

org.springframework:spring-expression MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.inftec.ju:ju-dbutil-test-legacy 4.1 - ch.ralscha:extdirectspring =1.3.0,...

ch.ralscha:extdirectspring (1.2.3), ch.tatool:tatool-app (>=1.3, <=1.3.2) +244 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (3.1.3.release)

org.springframework:spring-expression MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.ralscha:extdirectspring 1.2.3 - ch.tatool:tatool-app =1.3, =1.3, =1.3,...

com.geodevv.testing:irmina (>=1.0.0, <=1.0.2), com.github.dblock.waffle:waffle-spring-security3 (1.7.3) +105 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (3.2.12.release)

org.springframework:spring-expression MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.geodevv.testing:irmina =1.0.0, =2.5.0, =1.2.3, =1.4.19 and more Source...

cn.weforward:weforward-data-mysql (>=1.1.0, <=1.2.17), com.alibaba.otter:canal.client (>=1.0.25, <=1.1.0) +345 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.2.9.release)

org.springframework:spring-expression MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.weforward:weforward-data-mysql =1.1.0, =1.0.25, =1.0.25, =1.0.25, =1.0.25,...

ch.sbb.releasetrain:action (0.0.25), ch.sbb.releasetrain:config (0.0.25) +551 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.2.7.release)

org.springframework:spring-expression MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.sbb.releasetrain:action 0.0.25 - ch.sbb.releasetrain:config 0.0.25 -...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

ca.islandora.indexing:islandora-indexing-triplestore (>=0.0.1, <=0.0.2), com.alibaba.compileflow:compileflow (>=1.0.0-rc1, <=1.2.0) +316 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.2.11.release)

org.springframework:spring-expression MAVEN version 3.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.indexing:islandora-indexing-triplestore =0.0.1, =1.0.0-rc1,...

com.bytebybyte:google-geocoding (>=3.0.0, <=3.0.1), com.bytebybyte:mapquest-open-geocoding (1.0.0) +260 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.0.7.release)

org.springframework:spring-expression MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.bytebybyte:google-geocoding =3.0.0, =3.0.1 -...

at.molindo:spring-data-custom (>=0.0.1, <=0.0.2), au.com.mountain-pass:hyperstate (>=1, <=3) +850 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.2.4.release)

org.springframework:spring-expression MAVEN version 4.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo:spring-data-custom =0.0.1, =1, =4.1.final, =0.0.10, =0.0.10, =0.0....

co.paralleluniverse:comsat-spring-boot (0.3.0), co.paralleluniverse:comsat-spring-webmvc (0.3.0) +156 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.8.release)

org.springframework:spring-expression MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

com.github.inspektr:inspektr-support-spring (1.0.0.ga), fr.figarocms:web-debug-tag (>=0.0.1, <=1.0) +57 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.0.1.release)

org.springframework:spring-expression MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.inspektr:inspektr-support-spring 1.0.0.ga -...

at.molindo.social:spring-social-config (1.1.0.release), at.molindo.social:spring-social-core (1.1.0.release) +310 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.0.3.release)

org.springframework:spring-expression MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-config 1.1.0.release -...