ByteOS Network

Vulnerability Details :

CVE-2026-40985

Assigner-vmware

Assigner Org ID-dcf2e128-44bd-42ed-91e8-88f912c1401d

Published At-11 Jun, 2026 | 05:02

Updated At-11 Jun, 2026 | 12:47

Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:vmware

Assigner Org ID:dcf2e128-44bd-42ed-91e8-88f912c1401d

Published At:11 Jun, 2026 | 05:02

Updated At:11 Jun, 2026 | 12:47

▼CVE Numbering Authority (CNA)

Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

Affected Products

Vendor

VMware (Broadcom Inc.)

Product

Spring Web Flow

Default Status

unaffected

Versions

Affected

From 4.0.0 before 4.0.1 (custom)
From 3.0.0 before 3.0.2 (custom)
From 2.5.0 before 2.5.2 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-917	CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement

Type: CWE

CWE ID: CWE-917

Description: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement

Metrics

Version	Base score	Base severity	Vector
3.1	6.4	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Impacts

CAPEC ID	Description
N/A	An attacker who can influence EL expressions evaluated by WebFlowELExpressionParser can inject malicious Unified EL expressions and execute unintended logic.

CAPEC ID: N/A

Description: An attacker who can influence EL expressions evaluated by WebFlowELExpressionParser can inject malicious Unified EL expressions and execute unintended logic.

References

Hyperlink	Resource
https://spring.io/security/cve-2026-40985	N/A

Hyperlink: https://spring.io/security/cve-2026-40985

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@vmware.com

Published At:11 Jun, 2026 | 05:16

Updated At:11 Jun, 2026 | 15:21

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.4	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Type: Secondary

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CWE ID	Type	Source
CWE-917	Secondary	security@vmware.com

CWE ID: CWE-917

Type: Secondary

Source: security@vmware.com

References

Hyperlink	Source	Resource
https://spring.io/security/cve-2026-40985	security@vmware.com	N/A

Hyperlink: https://spring.io/security/cve-2026-40985

Source: security@vmware.com

Resource: N/A

Similar CVEs

6Records found

CVE-2026-41719

Matching Score-6

Assigner-VMware by Broadcom

View Details

Matching Score-6

Assigner-VMware by Broadcom

CVSS Score-6.4||MEDIUM

EPSS-0.05% / 14.77%

7 Day CHG~0.00%

Published-09 Jun, 2026 | 23:48

Updated-10 Jun, 2026 | 19:24

Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Vendor-VMware (Broadcom Inc.)

Product-Spring Data KeyValue Spring Data Redis

CWE ID-CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVE-2026-41717

Matching Score-6

Assigner-VMware by Broadcom

View Details

Matching Score-6

Assigner-VMware by Broadcom

CVSS Score-8.1||HIGH

EPSS-0.05% / 15.37%

7 Day CHG~0.00%

Published-09 Jun, 2026 | 23:48

Updated-11 Jun, 2026 | 03:55

Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

Vendor-VMware (Broadcom Inc.)

Product-Spring Data MongoDB

CWE ID-CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVE-2025-41243

Matching Score-6

Assigner-VMware by Broadcom

View Details

Matching Score-6

Assigner-VMware by Broadcom

CVSS Score-10||CRITICAL

EPSS-6.42% / 91.28%

7 Day CHG~0.00%

Published-16 Sep, 2025 | 14:54

Updated-26 Feb, 2026 | 17:48

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

Vendor-VMware (Broadcom Inc.)

Product-Cloud Gateway

CWE ID-CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2026-41705

Matching Score-6

Assigner-VMware by Broadcom

View Details

Matching Score-6

Assigner-VMware by Broadcom

CVSS Score-8.6||HIGH

EPSS-0.03% / 9.45%

7 Day CHG+0.01%

Published-09 May, 2026 | 00:34

Updated-12 May, 2026 | 19:26

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 or greater.

Vendor-VMware (Broadcom Inc.)

Product-spring_ai Spring AI

CWE ID-CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVE-2026-41729

Matching Score-6

Assigner-VMware by Broadcom

View Details

Matching Score-6

Assigner-VMware by Broadcom

CVSS Score-8.1||HIGH

EPSS-0.03% / 9.80%

7 Day CHG~0.00%

Published-09 Jun, 2026 | 23:49

Updated-11 Jun, 2026 | 03:55

Spring Data REST SpEL Injection via Map Key in JSON Patch

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

Vendor-VMware (Broadcom Inc.)

Product-Spring Data REST

CWE ID-CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVE-2026-22738

Matching Score-6

Assigner-VMware by Broadcom

View Details

Matching Score-6

Assigner-VMware by Broadcom

CVSS Score-9.8||CRITICAL

EPSS-0.06% / 17.59%

7 Day CHG~0.00%

Published-27 Mar, 2026 | 05:21

Updated-10 May, 2026 | 14:16

SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

Vendor-VMware (Broadcom Inc.)

Product-spring_ai Spring AI

CWE ID-CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE ID-CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVE-2026-40985

Credits

Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs