6.4
Moyenne
CVE-2026-40985 Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions
Description
Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Web Flow 4.0 | 4.0.0 → < 4.0.0.1 | 4.0.0.1 |
| Spring Web Flow 3.0 | 3.0.0 → < 3.0.1.1 | 3.0.1.1 |
| Spring Web Flow 2.5 | 2.5.0 → < 2.5.2 | 2.5.2 |