CVE-2026-59283

About vulnerability

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.

Specifically, an application is vulnerable when all of the following conditions are met:

• The application evaluates SpEL expressions using SimpleEvaluationContext.
• The SpEL expression compiler is active, either because the spring.expression.compiler.mode system property or Spring property has been set to IMMEDIATE or MIXED, or because a SpelParserConfiguration with SpelCompilerMode set to IMMEDIATE or MIXED was used to create the SpelExpressionParser.

When all conditions are met, the SpEL compiler can silently compile expressions evaluated within a SimpleEvaluationContext, causing subsequent evaluations to bypass all safety guards that are enforced during interpreted evaluation. The compiler may also cause unbounded class-loading growth, as each distinct compilable expression results in a new class being generated and loaded into a child ClassLoader.

Affected product:

Apache CXF , Apache Log4j , Apache Struts , Apache Tapestry , Apache Tomcat , Eclipse Jetty , Spring , activemq , amqp-10-jms-spring-boot , artemis , azure-spring-data-cosmos , camel , castor , cocoon , crash , cypher-dsl , glassfish-hk2 , gora , grails-core , grails-data-mapping , grails-gsp , grails-plugin-converters , hornetq , java-sdk , jersey , karaf , micronaut-spring , pulsar , rest-assured , tika

Affected packages:

Spring Framework @ 6.2.15 (+11837 more)