6.4
Medium
CVE-2026-40985 Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions
Description
Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Web Flow 4.0 | 4.0.0 → < 4.0.0.1 | 4.0.0.1 |
| Spring Web Flow 3.0 | 3.0.0 → < 3.0.1.1 | 3.0.1.1 |
| Spring Web Flow 2.5 | 2.5.0 → < 2.5.2 | 2.5.2 |