EUVD-2026-66854

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

cve-2022-42889-text4shell

Установка Maven - maven-linux 1. Установка Maven для создания fat jar root@kitploit: mvn clean install 2. Сборка Docker root@kitploit: docker build --tag=text4shell . 3. Запуск Docker root@kitploit: docker run -p 80:8080 text4shell 4. Проверьте приложение root@kitploit:...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 демонстрационный тест пожалуйста, ОБНОВИТЕ spring data rest СЕЙЧАС. шаги Запустите это приложение Создайте тестовый экземпляр root@kitploit: POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2"...

CVE-2026-22738

Environnement de reproduction CVE-2026-22738 Description de la vulnérabilité CVE-2026-22738 est une vulnérabilité d'injection SpEL Spring Expression Language dans SimpleVectorStore de Spring AI, permettant une exécution de code à distance RCE non authentifiée. Versions affectées...

CVE-2026-41849

CVE-2026-41849...

ROOT-APP-MAVEN-CVE-2026-41850 CVE-2026-41850 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2026-41850 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38808 CVE-2024-38808 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2024-38808 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-20861 CVE-2023-20861 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2023-20861 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-20863 CVE-2023-20863 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2023-20863 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance

Summary The spring package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-41850, CVE-2026-41851, CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41850, CVE-2026-41851, CVE-2026-41852]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Spring Framework is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-expression jar

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41850, CVE-2026-41851 and CVE-2026-41852 reported for spring-expression-6.2.12.jar, spring-expression-6.2.18.jar . Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-expression-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

CVE-2026-41850

A flaw was found in Spring Framework. Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. A remote attacker can exploit this by providing a specially crafted expression, which triggers excessive resource...

K000162182: Spring Expression Language (SpEL) vulnerability CVE-2026-41850

Security Advisory Description Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading...

K000162130: Spring Framework vulnerability CVE-2026-41851

Security Advisory Description Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. Affected versions: Spring Framework 7.0.0 through 7.0.7;...

Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Denial of Service (Dos) attacks, and Incorrect Authorization attacks

Summary IBM Terracotta uses Spring Framework as an application foundation within the product. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By...

CVE-2026-41852

A flaw was found in Spring Framework. A vulnerability in the Spring Expression Language SpEL evaluation logic allows an attacker to invoke arbitrary zero-argument methods, even in restricted contexts. This can lead to the execution of unintended application logic, potentially resulting in a Denia...

CVE-2026-41719

A flaw was found in Spring Data KeyValue. This vulnerability, known as a Spring Expression Language SpEL Injection, allows a remote attacker with low privileges to execute arbitrary expressions. This occurs when unsanitized user input is passed as a sorting parameter into a repository query metho...