CVE-2011-2730: Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework
Summary
CVE-2011-2730: Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework. Affects org.springframework:spring-core across 3 version ranges.
< 2.5.6.SEC03
>= 2.5.7.SR0, < 2.5.7.SR023
>= 3.0.0, < 3.0.6
Fixed in 2.5.6.SEC03, 2.5.7.SR023 or 3.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The framework includes various modules, such as spring-core, which is responsible for core utilities and features. The vulnerability affects versions of the Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6. It specifically impacts containers that support Expression Language (EL) and involves the improper neutralization of directives in dynamically evaluated code.
Vulnerability Detail
The vulnerability arises from the Spring Framework's double evaluation of EL expressions in certain tags. This allows remote attackers to obtain sensitive information by exploiting various attributes in specific tags. For example, an attacker can leverage the 'name' attribute in a 'spring:hasBindErrors' tag or the 'path' attribute in 'spring:bind' or 'spring:nestedpath' tags to retrieve sensitive data. Similarly, other attributes in 'spring:message', 'spring:theme', and 'spring:transform' tags can also be exploited. This vulnerability is known as 'Expression Language Injection' and can lead to the disclosure of sensitive information.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.6.SEC032.5.6.SEC03 -
>= 2.5.7.SR0, < 2.5.7.SR0232.5.7.SR023 -
>= 3.0.0, < 3.0.63.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can disable the use of Expression Language (EL) in their Spring Framework configurations. This can be achieved by configuring the framework to use a different expression language or by disabling EL entirely. However, this workaround may impact the functionality of the application and should be carefully evaluated before implementation.
Conclusion
The vulnerability in the Spring Framework allows remote attackers to obtain sensitive information by exploiting certain tags that support Expression Language (EL). To mitigate this risk, it is crucial to upgrade to the latest secure versions of the Spring Framework and review any custom code that may be affected. Disabling EL or using alternative expression languages can serve as a temporary workaround, but it is recommended to implement the official fix. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-core →
FAQ
The vulnerability allows remote attackers to obtain sensitive information from the application. This can include user credentials, database connection details, or any other sensitive data accessible through the affected tags.
No, only versions before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6 are vulnerable. It is recommended to upgrade to the latest secure versions to mitigate the risk.
While specific exploits may not be publicly available, the vulnerability has been identified and documented. It is crucial to address this vulnerability promptly to prevent potential attacks.
Yes, remote attackers can exploit this vulnerability by sending malicious requests to the affected application. It is important to secure the application and implement the necessary fixes to prevent unauthorized access.
Yes, more details about this vulnerability can be found in the National Vulnerability Database (NVD) entry with the CVE identifier CVE-2011-2730.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-core.
