CVE-2026-41852: Spring Framework Arbitrary Method Invocation in SpEL Expressions
Summary
CVE-2026-41852: Spring Framework Arbitrary Method Invocation in SpEL Expressions. Affects org.springframework:spring-expression across 4 version ranges.
< 5.3.39
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.19
>= 7.0.0, < 7.0.8
Fixed in 5.3.39, 6.2.19 or 7.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a widely-used open-source framework for building Java applications. It provides comprehensive infrastructure support for developing Java applications, allowing developers to focus on building their business logic. One of its components, Spring Expression Language (SpEL), enables querying and manipulation of objects at runtime. However, vulnerabilities in SpEL can lead to severe security risks, such as arbitrary method invocation, which can compromise application integrity.
Vulnerability Detail
A vulnerability in the Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts. This means that an attacker could exploit this flaw to invoke unintended application logic, potentially leading to unauthorized access or manipulation of application data. The vulnerability affects multiple versions of the Spring Framework, making it critical for users to address it promptly.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.196.2.19 -
>= 7.0.0, < 7.0.87.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider restricting the use of SpEL in your application or implementing additional security measures to validate and sanitize inputs before processing them through SpEL.
Conclusion
CVE-2026-41852 represents a significant security risk for applications using vulnerable versions of the Spring Framework. It is crucial for developers to update their dependencies to the patched versions to mitigate potential threats. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for org.springframework:spring-expression →
FAQ
CVE-2026-41852 is a vulnerability in the Spring Framework that allows for arbitrary method invocation through the Spring Expression Language (SpEL).
Affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
The vulnerability can lead to unauthorized access and manipulation of application logic, potentially compromising the integrity and security of the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-expression.
