MavenPackage

org.springframework:spring-expression

8 known vulnerabilities (2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 7.0.10 (Oct 22, 2026): no advisory affects it
Newest unaffected release: 7.0.10 (Oct 22, 2026), the latest release
Advisories: 8 · 2 high, 3 medium, 1 low

Dependents: 1,826
Releases: 294 since 3.0.0.RELEASE (Dec 17, 2009)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-41852
Affects 3.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
CVE-2026-41851
Affects 3.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
CVE-2026-41850
Affects 3.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
CVE-2026-41849
Affects 3.0.0.RELEASE to 5.3.39 (6.0.0 is outside it)
CVE-2024-38808
Affects 3.0.0.RELEASE to 5.3.38 (5.3.39 is outside it)
CVE-2023-20863
Affects 3.0.0.RELEASE to 5.2.23.RELEASE (5.2.24.RELEASE is outside it); 5.3.0 to 5.3.26 (5.3.27 is outside it); 6.0.0 to 6.0.7 (6.0.8 is outside it)
CVE-2023-20861
Affects 3.0.0.RELEASE to 5.2.22.RELEASE (5.2.23.RELEASE is outside it); 5.3.0 to 5.3.25 (5.3.26 is outside it); 6.0.0 to 6.0.6 (6.0.7 is outside it)
CVE-2022-22950
Affects 3.0.0.RELEASE to 5.2.19.RELEASE (5.2.20.RELEASE is outside it); 5.3.0 to 5.3.16 (5.3.17 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-41852Low 3.7
Spring Framework Arbitrary Method Invocation in SpEL Expressions
Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.
Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).
The latest release, 7.0.10, is not affected.
CVE-2026-41851Medium 5.3
Spring Framework Denial of Service via Unbounded Cache in SpEL
Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.
Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).
The latest release, 7.0.10, is not affected.
CVE-2026-41850High 7.5
Spring Framework Algorithmic Denial of Service via SpEL Expressions
Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.
Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).
The latest release, 7.0.10, is not affected.
CVE-2026-41849High 7.5
Spring Framework Denial of Service via Integer Overflow in SpEL Expressions
Affected: through 5.3.39.
Fixed in 6.0.0 (released Nov 16, 2022, 1301 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 7.0.10, is not affected.
CVE-2024-38808Medium 4.3
CVE-2024-38808: Spring Expression DoS Vulnerability
Affected: fixed in 5.3.39.
Fixed in 5.3.39 (released Aug 14, 2024, 6 days before disclosure).
The latest release, 7.0.10, is not affected.
CVE-2023-20863Medium 6.5
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL…
Affected: from 6.0.0, fixed in 6.0.8; from 5.3.0, fixed in 5.3.27; fixed in 5.2.24.RELEASE.
Fixed in 5.2.24.RELEASE (released Apr 13, 2023, the day of disclosure), 5.3.27 (released Apr 13, 2023, the day of disclosure) and 6.0.8 (released Apr 13, 2023, the day of disclosure).
The latest release, 7.0.10, is not affected.
CVE-2023-20861Unrated
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible…
Affected: from 6.0.0, fixed in 6.0.7; from 5.3.0, fixed in 5.3.26; fixed in 5.2.23.RELEASE.
Fixed in 5.2.23.RELEASE (released Mar 20, 2023, 3 days before disclosure), 5.3.26 (released Mar 20, 2023, 3 days before disclosure) and 6.0.7 (released Mar 20, 2023, 3 days before disclosure).
The latest release, 7.0.10, is not affected.
CVE-2022-22950Unrated
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL exp
Affected: from 5.3.0, fixed in 5.3.17; fixed in 5.2.20.RELEASE.
Fixed in 5.2.20.RELEASE (released Mar 31, 2022, 1 day before disclosure) and 5.3.17 (released Mar 17, 2022, 15 days before disclosure).
The latest release, 7.0.10, is not affected.