CVE-2026-40985: Spring Web Flow Data Binding Vulnerability with Unified EL Parser
Summary
CVE-2026-40985: Spring Web Flow has Data Binding Vulnerability with Unified EL Parser. Affects org.springframework.webflow:spring-webflow across 3 version ranges.
< 2.5.1
>= 3.0.0, < 3.0.2
>= 4.0.0, < 4.0.1
Fixed in 2.5.1, 3.0.2 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Web Flow is a powerful framework that facilitates the development of web applications by providing a structured way to manage the flow of web interactions. It allows developers to define complex workflows and manage user interactions seamlessly. However, certain configurations of the WebFlowELExpressionParser can expose applications to vulnerabilities, particularly through the use of malicious Unified EL expressions.
Vulnerability Detail
The vulnerability arises from the improper handling of Unified EL expressions in Spring Web Flow, specifically when the WebFlowELExpressionParser is configured. This flaw allows attackers to inject malicious expressions, potentially leading to unauthorized access or manipulation of application data. The affected versions include Spring Web Flow 4.0.0, 3.0.0 through 3.0.1, and 2.5.0 through 2.5.1. The ramifications of this vulnerability can be severe, as it may compromise the integrity and confidentiality of user data.
How To Fix
Latest published version: 4.0.1 as of 23 Oct 2026
The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.12.5.1 -
>= 3.0.0, < 3.0.23.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the WebFlowELExpressionParser in configurations where user input can be directly evaluated. Instead, consider validating and sanitizing input before processing it through the expression parser.
Conclusion
In summary, CVE-2026-40985 presents a significant risk to applications using vulnerable versions of Spring Web Flow due to improper handling of Unified EL expressions. It is crucial to update to the latest patched versions to mitigate this risk and ensure application security.
See every vulnerability recorded for org.springframework.webflow:spring-webflow →
FAQ
CVE-2026-40985 is a vulnerability in Spring Web Flow that allows the injection of malicious Unified EL expressions, potentially compromising application security.
Affected versions include Spring Web Flow 4.0.0, 3.0.0 through 3.0.1, and 2.5.0 through 2.5.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check your application using the Vulert playground without signup.
The CVSS score of this vulnerability is 6.4, indicating a moderate level of severity.
If immediate updates are not possible, implement input validation and avoid using the vulnerable parser to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.webflow:spring-webflow.
