Spring Security Advisories

CVE-2026-40985: Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

MEDIUM | JUNE 10, 2026 | CVE-2026-40985

Description

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions.

Pre-conditions:

The application explicitly configures the WebFlowELExpressionParser or its base class "ELExpressionParser".
The useSpringBinding configuration property has not been set to true.
View states do not use the <binding> element on a view state to declare the properties to bind.

Affected Spring Products and Versions

Spring Web Flow:

4.0.0 - 4.0.0
3.0.0 - 3.0.1
2.5.0 - 2.5.1
Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)	Fix version	Availability
4.0.x	4.0.1	OSS
	4.0.0.1	Enterprise Support Only
3.0.x	3.0.2	OSS
	3.0.1.1	Enterprise Support Only
2.5.x	2.5.2	Enterprise Support Only

No further mitigation steps are necessary.

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N&version=3.1

History

2026-06-10: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy