Improper Control of Dynamically-Managed Code Resources in Spring Framework - CVE-2026-59283
Published: August 31, 2026
Vulnerability identifier: #VU146382
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59283
CWE-ID: CWE-913
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to improper control of dynamically-managed code resources in Spring Expression Language (SpEL) expression evaluation when evaluating expressions using SimpleEvaluationContext with the SpEL expression compiler active. A remote attacker can supply specially crafted expressions to disclose sensitive information and cause a denial of service.
The issue occurs only when expressions are evaluated with SimpleEvaluationContext and expression compilation is enabled through compiler mode settings such as IMMEDIATE or MIXED.
Affected software
Spring Framework
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-59283
Install security update from vendor's website.
Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19