Improper Control of Dynamically-Managed Code Resources in Spring Framework - CVE-2026-59283
Published: August 31, 2026
Vulnerability identifier: #VU146382
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59283
CWE-ID: CWE-913
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to improper control of dynamically-managed code resources in Spring Expression Language (SpEL) expression evaluation when evaluating expressions using SimpleEvaluationContext with the SpEL expression compiler active. A remote attacker can supply specially crafted expressions to disclose sensitive information and cause a denial of service.
The issue occurs only when expressions are evaluated with SimpleEvaluationContext and expression compilation is enabled through compiler mode settings such as IMMEDIATE or MIXED.
Affected software
Spring Framework
Db2 Developer Extension
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
Library Support for Spring
IBM Sterling Control Center
IBM Netezza Performance Server
Db2 Developer Extension
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
Library Support for Spring
IBM Sterling Control Center
IBM Netezza Performance Server
How to mitigate CVE-2026-59283
Install security update from vendor's website.
Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Db2 Developer Extension - update to 1.2.1
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
IBM Sterling Control Center - addressed in versions 6.3.1.0.12, 6.4.2.0.8
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0
IBM Netezza Performance Server - update to 11.3.1.3 IF6
Db2 Developer Extension - update to 1.2.1
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
IBM Sterling Control Center - addressed in versions 6.3.1.0.12, 6.4.2.0.8
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0
IBM Netezza Performance Server - update to 11.3.1.3 IF6
External References
Related Security Bulletins
- Multiple vulnerabilities in Spring Framework
- Multiple vulnerabilities in IBM Library Support for Spring
- IBM Control Center update for Spring Framework
- Multiple vulnerabilities in IBM Netezza Performance Server
- IBM Db2 Developer Extension update for Spring Framework
- Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data