# org.springframework:spring-expression (Maven) vulnerabilities 8 known vulnerabilities (2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.0.10 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 7.0.10 (Oct 22, 2026), the latest release - Dependents: 1,826 - Releases: 294 since 3.0.0.RELEASE (Dec 17, 2009) - Registry: https://central.sonatype.com/artifact/org.springframework/spring-expression - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-41852: 3.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41851: 3.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41850: 3.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41849: 3.0.0.RELEASE to 5.3.39 (6.0.0 is outside it) - CVE-2024-38808: 3.0.0.RELEASE to 5.3.38 (5.3.39 is outside it) - CVE-2023-20863: 3.0.0.RELEASE to 5.2.23.RELEASE (5.2.24.RELEASE is outside it); 5.3.0 to 5.3.26 (5.3.27 is outside it); 6.0.0 to 6.0.7 (6.0.8 is outside it) - CVE-2023-20861: 3.0.0.RELEASE to 5.2.22.RELEASE (5.2.23.RELEASE is outside it); 5.3.0 to 5.3.25 (5.3.26 is outside it); 6.0.0 to 6.0.6 (6.0.7 is outside it) - CVE-2022-22950: 3.0.0.RELEASE to 5.2.19.RELEASE (5.2.20.RELEASE is outside it); 5.3.0 to 5.3.16 (5.3.17 is outside it) ## Advisories (8) ### [CVE-2026-41852](https://cve.now/CVE-2026-41852): Spring Framework Arbitrary Method Invocation in SpEL Expressions - Severity: Low 3.7 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41851](https://cve.now/CVE-2026-41851): Spring Framework Denial of Service via Unbounded Cache in SpEL - Severity: Medium 5.3 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41850](https://cve.now/CVE-2026-41850): Spring Framework Algorithmic Denial of Service via SpEL Expressions - Severity: High 7.5 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41849](https://cve.now/CVE-2026-41849): Spring Framework Denial of Service via Integer Overflow in SpEL Expressions - Severity: High 7.5 - Published: Jun 9, 2026 - Affected: through 5.3.39. - Fixed in 6.0.0 (released Nov 16, 2022, 1301 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 7.0.10, is not affected. ### [CVE-2024-38808](https://cve.now/CVE-2024-38808): CVE-2024-38808: Spring Expression DoS Vulnerability - Severity: Medium 4.3 - Published: Aug 20, 2024 - Affected: fixed in 5.3.39. - Fixed in 5.3.39 (released Aug 14, 2024, 6 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2023-20863](https://cve.now/CVE-2023-20863): In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL… - Severity: Medium 6.5 - Published: Apr 13, 2023 - Affected: from 6.0.0, fixed in 6.0.8; from 5.3.0, fixed in 5.3.27; fixed in 5.2.24.RELEASE. - Fixed in 5.2.24.RELEASE (released Apr 13, 2023, the day of disclosure), 5.3.27 (released Apr 13, 2023, the day of disclosure) and 6.0.8 (released Apr 13, 2023, the day of disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2023-20861](https://cve.now/CVE-2023-20861): In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible… - Severity: Unrated - Published: Mar 23, 2023 - Affected: from 6.0.0, fixed in 6.0.7; from 5.3.0, fixed in 5.3.26; fixed in 5.2.23.RELEASE. - Fixed in 5.2.23.RELEASE (released Mar 20, 2023, 3 days before disclosure), 5.3.26 (released Mar 20, 2023, 3 days before disclosure) and 6.0.7 (released Mar 20, 2023, 3 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2022-22950](https://cve.now/CVE-2022-22950): n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL exp - Severity: Unrated - Published: Apr 1, 2022 - Affected: from 5.3.0, fixed in 5.3.17; fixed in 5.2.20.RELEASE. - Fixed in 5.2.20.RELEASE (released Mar 31, 2022, 1 day before disclosure) and 5.3.17 (released Mar 17, 2022, 15 days before disclosure). - The latest release, 7.0.10, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.springframework:spring-expression Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.