CVE-2026-41852

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48

Description A flaw in the Spring Expression Language (SpEL) evaluation logic enables the invocation of arbitrary zero-argument methods. This occurs even when the system is operating within restricted or read-only contexts, potentially allowing an attacker to trigger unintended application logic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.