CVE-2026-41852 PUBLISHED

Spring Framework Arbitrary Method Invocation in SpEL Expressions

Assigner: vmware
Reserved: 22.04.2026 Published: 09.06.2026 Updated: 09.06.2026

A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 3.7

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Spring
Product	Spring Framework
Versions	Default: unaffected affected from 7.0.0 to 7.0.8 (excl.) affected from 6.2.0 to 6.2.19 (excl.) affected from 6.1.0 to 6.1.28 (excl.) affected from 5.3.0 to 5.3.49 (excl.)

References

https://spring.io/security/cve-2026-41852

Problem Types

CWE-863: Incorrect Authorization CWE

Impacts

An attacker who can supply user-controlled SpEL expressions can invoke arbitrary zero-argument methods even within restricted or read-only SpEL contexts, potentially triggering unintended application logic.