Loading story…
A high-severity denial-of-service flaw, CVE-2026-41849, was disclosed in the Spring Framework SpEL evaluation engine, where an integer overflow can let a remote, unauthenticated attacker exhaust resources if a network-exposed application evaluates attacker-controlled expressions. The issue affects Spring Framework 5.3.0 through 5.3.48 and carries a CVSS 3.1 score of 7.5, with impact limited to availability.
Spring said the vulnerability applies to the 5.3.x branch and that newer releases 6.2.19 and 7.0.8 are not affected. Public open-source remediation is available in those newer branches, while the fix for 5.3.x is 5.3.49 and is available through commercial Tanzu Spring Enterprise because the 5.3 line has reached end of life; no public proof-of-concept or confirmed in-the-wild exploitation had been reported at publication time.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Spring stated that CVE-2026-41847 and CVE-2026-41849 apply to the Spring Framework 5.3.x branch, while versions 6.2.19 and 7.0.8 are not affected.
On June 8, 2026, Spring released Framework versions 6.2.19 and 7.0.8. These public OSS releases were noted as containing fixes related to CVE-2026-41849 and were stated to be unaffected by CVE-2026-41847 and CVE-2026-41849.
The Spring Framework 5.3 branch reached open-source end of life in August 2024, making later 5.3.x fixes unavailable as public OSS releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spring disclosed a broad set of vulnerabilities across **Spring Framework**, **Spring Data Commons**, and **Spring LDAP**, including a high-severity authentication bypass tracked as `CVE-2026-41720`. The LDAP flaw allows login with a valid username and an empty or null password when the backing LDAP server permits unauthenticated binds, affecting authentication flows that use `AbstractContextSource`, `LdapTemplate`, or `LdapClient`. Spring also fixed a low-severity WebFlux session fixation issue (`CVE-2026-41839`) tied to compromised subdomains, and an information disclosure bug (`CVE-2026-41841`) in Spring MVC and WebFlux where shared static-resource caches could expose protected files if a public resource with the same name had already been cached. Several denial-of-service issues were patched at the same time. In Spring Framework, `CVE-2026-41840` can leak memory through malicious multipart requests in WebFlux, while `CVE-2026-41842` can tie up HTTP connections through slow resolution of versioned file-system resources in Spring MVC or WebFlux. In Spring Data Commons, `CVE-2026-41695`, `CVE-2026-41711`, `CVE-2026-41716`, and `CVE-2026-41721` can be triggered by attacker-controlled property paths, sort parameters, property names, or `@ProjectedPayload` data binding, leading to stack overflows, heap exhaustion, or excessive memory allocation when applications expose those inputs to untrusted users. Spring urged customers to upgrade to fixed releases, including Framework `7.0.8`, `6.2.19`, and `6.1.28`, Data Commons `4.0.6` and `3.5.12`, and LDAP `2.4.5`, `3.2.18`, `3.3.8`, or `4.0.4`, with some older branches receiving fixes only through commercial support.
Jun 29, 2026
A critical flaw tracked as **`CVE-2026-40478`** allows attackers to bypass Thymeleaf’s expression-injection protections and achieve **server-side template injection (SSTI)** in applications that pass unvalidated user input into the template engine. The vulnerability affects **Thymeleaf 3.1.3.RELEASE and earlier** and stems from improper neutralization of syntax patterns in expression execution, including a whitespace parsing mismatch that let attackers evade detection of the SpEL `new` keyword and an incomplete type blocklist that still allowed dangerous class instantiation. The issue is mapped to **`CWE-917`** and **`CWE-1336`**, with a published **CVSS v3.1** vector of **`AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`**. Researchers said successful exploitation can enable arbitrary file writes and potentially remote code execution in **Spring-based Java applications**, where Thymeleaf is commonly used as the default template engine in Spring Boot. The flaw can be exploited remotely without authentication when attacker-controlled input reaches Thymeleaf expression parsing, view names, or fragment selectors. The issue is addressed in **`3.1.4.RELEASE`**, which normalizes whitespace before checks, expands external-access detection, restricts dangerous expression objects, and tightens type restrictions; defenders are urged to upgrade **`thymeleaf`**, **`thymeleaf-spring5`**, and **`thymeleaf-spring6`** and review applications to ensure untrusted input is never interpreted as template expressions.
Jun 29, 2026
The Canadian Centre for Cyber Security issued advisory **AV26-288** warning that multiple vulnerabilities disclosed by Spring affect **Spring Cloud Config** and **Spring AI**, including **server-side request forgery (SSRF)**, unintended file access, query injection, and a **SpEL injection** that can lead to **remote code execution (RCE)**. The notice says the issues were disclosed by Spring between March 23 and 26 and urged organizations to review the vendor advisories and assess exposure in affected deployments. Affected versions include **Spring Cloud Config** releases prior to **3.1.3**, **4.1.9**, **4.2.6**, **4.3.2**, and **5.0.2**, along with **Spring AI** versions prior to **1.0.5** and **1.1.4**. The Cyber Centre advised administrators and users to apply the relevant updates to reduce the risk of exploitation against exposed services and vulnerable application environments.
Jun 29, 2026