Executive brief
The Spring Framework, a widely used foundation for building Java applications, contains a flaw in how it processes certain internal expressions. This issue allows an attacker to trigger specific functions within the application that were intended to be restricted or read-only. While the risk is rated as low, it could lead to unintended application behavior or minor service disruptions.
Technical details
A vulnerability exists in the Spring Expression Language (SpEL) evaluation logic within the spring-expression module. The root cause is an incorrect authorization check (CWE-863) that fails to properly restrict method calls in supposedly limited or read-only evaluation contexts. A remote attacker can exploit this by providing crafted SpEL expressions that invoke arbitrary zero-argument methods, potentially triggering unintended application logic. The attack complexity is considered high as it requires the application to be configured to evaluate user-supplied SpEL in a restricted context. Patches are available in versions 7.0.8 and 6.2.19.
Affected products
- VMware Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-07-30: patched