CVE-2026-59283: Spring Framework Safety Guard Bypass via SpEL Expression Compilation
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.2.25.RELEASE - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.3.0 - 5.3.49 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.0.0 - 6.0.30 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.1.0 - 6.1.28 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.2.0 - 6.2.19 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 7.0.0 - 7.0.8
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they evaluate SpEL expressions with SimpleEvaluationContext while the SpEL expression compiler is active. The affected Spring Framework version ranges include 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.
Is a default Spring Framework installation affected?
The issue requires both use of SimpleEvaluationContext for SpEL evaluation and an active SpEL expression compiler. The provided information does not establish that these conditions are enabled by default.
How can teams determine whether they are affected?
Review application code and configuration for SpEL expression evaluation using SimpleEvaluationContext, then determine whether the SpEL expression compiler is active in those execution paths. Also compare the deployed Spring Framework version against the listed affected ranges.