Loading vulnerability…
Spring Web Flow Unified EL Data Binding Vulnerability
CVE-2026-40985 is a medium-severity data-binding vulnerability in Spring Web Flow's Unified Expression Language handling. Applications that explicitly configure WebFlowELExpressionParser or its ELExpressionParser base class can process attacker-supplied malicious Unified EL expressions during data binding. Affected releases are Spring Web Flow 4.0.0, 3.0.0 through 3.0.1, and 2.5.0 through 2.5.1; older unsupported releases are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized evaluation of malicious Unified EL expressions in the vulnerable application's context. Depending on the application's expression exposure and accessible objects, this can compromise confidentiality and integrity. The published CVSS v3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, indicating network reachability but high attack complexity, low privileges, user interaction, high confidentiality and integrity impact, and no availability impact.
If you can’t patch tonight, do this now.
Upgrade to a fixed release; no additional mitigation is specified as necessary. Where immediate upgrading is not possible, review and restrict exposure of data-binding endpoints that accept attacker-controlled input and avoid vulnerable Unified EL parser configurations where operationally feasible.
Patch, then assume compromise.
Upgrade Spring Web Flow to a fixed release: 4.0.1 or later for the 4.0.x branch, or 3.0.2 or later for the 3.0.x branch. Enterprise Support customers may use 4.0.0.1 for the 4.0.x branch, 3.0.1.1 for the 3.0.x branch, or 2.5.2 for the 2.5.x branch. Deploy a supported non-vulnerable release for affected 2.5.x and older unsupported versions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.