CVE-2026-41852: Spring Expression Language Method Invocation Bypass

Technical summary

The vulnerability exists in SpEL's evaluation logic, which fails to properly enforce access restrictions on method invocation during expression parsing and execution. Specifically, zero-argument methods can be invoked even when the expression context should be read-only or sandboxed. The affected CWE-863 classification (Incorrect Authorization) indicates the core issue is inadequate access control validation. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects that while exploitability requires specific application conditions (AC:H), the vulnerability is remotely reachable with no authentication needed, and impact is limited to availability.

Business impact

Organizations running vulnerable Spring Framework versions should evaluate whether SpEL is used to process untrusted input in their applications. If so, an attacker could disrupt availability by triggering resource-intensive zero-argument methods, or in some configurations, extract information through side-channel invocation. The low CVSS score and authorization-class nature of the flaw mean impact is typically constrained to application-specific logic; however, organizations relying on Spring's expression sandbox for security boundaries must treat this as a logic-bypass risk.

Affected systems

VMware Spring Framework versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48 are affected. All currently-maintained branches contain the vulnerability. Systems running older versions (pre-5.3.0) or patched versions outside these ranges are not affected. Organizations should verify their exact Spring Framework version in build manifests and dependency trees.

Exploitability

Exploitation requires network access and depends on application context (AC:H per CVSS). Not all Spring Framework deployments are vulnerable—only those that parse SpEL expressions containing attacker-controlled input or rely on SpEL restrictions as a security boundary. The barrier to exploitation is higher than typical remote code execution flaws; the attacker must understand the target application's available methods and construct a zero-argument invocation that causes harm. This is not listed on the CISA Known Exploited Vulnerabilities catalog, indicating no active weaponization has been tracked as of publication.

Remediation

Update Spring Framework to a patched version outside the affected ranges. VMware has released patches addressing the SpEL evaluation logic; consult the official Spring Security and Framework advisories for specific version numbers and availability across the 5.3, 6.1, 6.2, and 7.0 lines. If immediate patching is not feasible, restrict untrusted input to SpEL expressions and avoid relying on read-only context markers as a sole security control. Code review of SpEL usage is recommended to identify risky patterns.

Patch guidance

Verify the specific patched version numbers in VMware's official Spring Framework security advisory, which will list the first non-vulnerable build for each affected branch. Patches are typically released concurrently across all supported versions. Test patches in a non-production environment to ensure compatibility with your application dependencies before rolling out to production. Given the low severity and authorization-focused nature of the flaw, patching can often be scheduled in a normal maintenance window rather than as an emergency response.

Detection guidance

Monitor application logs for SpEL parsing exceptions or unexpected method invocations on system or utility classes. Use static analysis tools (e.g., Checkmarx, SonarQube) to identify where SpEL expressions are evaluated, particularly those processing user input or external data. Dynamic testing should include fuzzing SpEL expressions with method invocation payloads to confirm whether read-only contexts are enforced. Check dependency manifests (pom.xml, gradle.build) for Spring Framework versions within the affected ranges.

Why prioritize this

This vulnerability has a low CVSS score (3.7) and is not on the KEV catalog, indicating limited active exploitation risk. However, prioritization should account for whether your application parses untrusted SpEL expressions. If SpEL is not used, or only processes internal/trusted data, this is a routine patch candidate. If SpEL processes user-supplied input or is relied upon for authorization enforcement, elevate priority to within the next maintenance cycle. The multi-version impact across four release branches means most Spring Framework users should plan patching, though urgency varies by use case.

Risk score, explained

The CVSS 3.1 score of 3.7 (LOW) reflects three key factors: (1) the vulnerability does not permit remote code execution or confidentiality breach; (2) exploitation requires high complexity (AC:H) in application-specific contexts; and (3) impact is limited to availability and only when attacker-controlled methods are available. The severity is not inflated by authentication requirements (PR:N) or broad attack surface. The CWE-863 authorization flaw classification accurately describes the root cause, but does not elevate score because the vulnerability class typically yields lower CVSS outcomes without confidentiality or integrity violations.

Frequently asked questions