Skip to main content

Improper Control of Dynamically-Managed Code Resources

CVE-2026-59283

High
9.1/10

Summary

Applications that evaluate Spring Expression Language (SpEL) expressions using "SimpleEvaluationContext" may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. This issue affects Spring Framework versions through 5.2.25.RELEASE, 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19 and 7.0.0 through 7.0.8.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-913 - Improper Control of Dynamically-Managed Code Resources

The software does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

References

Advisory Timeline

  • Published