MEDIUMCVSS 6.4EPSS 0.2%

CVE-2026-40985

CVE-2026-40985 updated by NVD

Published: 2026-06-11
Modified: 2026-09-06
EPSS percentile: 13%
Sources: github-advisory, nvd

Summary

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.springframework.webflow:spring-webflow	—	4.0.1, 3.0.2

Remediation: Upgrade to 4.0.1 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-40985

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.