CVE-2026-59283

Received Received - Intake

Spring Expression Language Compiler Bypass in Spring Framework

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-59283

Affected Vendors & Products

Vendor	Product	Version / Range
spring_project	spring_framework	7.0.0
spring_project	spring_framework	6.2.0
spring_project	spring_framework	6.1.0
spring_project	spring_framework	6.0.0
spring_project	spring_framework	5.3.0
spring_project	spring_framework	to 5.2.26 (exc)
spring_project	spring_framework	From 7.0.0 (inc) to 7.0.8 (inc)
spring_project	spring_framework	From 6.2.0 (inc) to 6.2.19 (inc)
spring_project	spring_framework	From 6.1.0 (inc) to 6.1.28 (inc)
spring_project	spring_framework	From 6.0.0 (inc) to 6.0.30 (inc)
spring_project	spring_framework	From 5.3.0 (inc) to 5.3.49 (inc)
spring_project	spring_framework	to 5.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects applications using Spring Framework's SimpleEvaluationContext to evaluate Spring Expression Language (SpEL) expressions. When the SpEL compiler is enabled, it can bypass safety checks that are normally enforced during interpreted evaluation. This happens because the compiler silently compiles expressions without applying the same restrictions, potentially allowing unsafe operations.

Detection Guidance

Check if your Spring Framework version is within the affected range (5.2.25 and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8). Inspect application logs for SpEL expression compilation attempts or unbounded class-loading growth.

Impact Analysis

An attacker could exploit this to execute malicious SpEL expressions, leading to unauthorized actions or data access. Additionally, it may cause unbounded class-loading growth, as each compiled expression generates a new class in a child ClassLoader, potentially leading to resource exhaustion or denial of service.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized code execution through SpEL expression evaluation. If exploited, it may allow attackers to bypass safety checks, leading to data breaches or unauthorized access to sensitive information, which violates GDPR's data protection principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade to fixed versions: 7.0.9 (OSS), 7.0.8.1 (Enterprise), 6.2.20 (Enterprise), 6.1.29 (Enterprise), 6.0.31 (Enterprise), 5.3.50 (Enterprise), or 5.2.26 (Enterprise). If compilation is required, enable it explicitly via withCompilationSupported() but be aware of the increased risk.

Hi! I’m here to help you understand CVE-2026-59283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70