Maven org.springframework:spring-expression

Name: Maven org.springframework:spring-expression
Brand: Maven

productUS

pkg:maven/org.springframework/spring-expression

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

critical

by severity

0critical1high4medium0low

updated 2026-10-28

vulnerabilities (8)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2022-22950US	medium6.5	36.1% (98th)	—	5.3.17	2022-04-01	2 versions
CVE-2023-20863US	medium6.5	1.12% (66th)	—	5.3.27	2023-04-13	3 versions
CVE-2023-20861US	medium6.5	0.97% (62nd)	—	5.3.26	2023-03-23	3 versions
CVE-2024-38808US	—	0.57% (47th)	—	5.3.39	2024-08-20	< 5.3.39
CVE-2026-41851US	high7.5	0.39% (33rd)	—	6.2.19	2026-06-09	4 versions
CVE-2026-41850US	—	0.39% (33rd)	—	7.0.8	2026-06-09	4 versions
CVE-2026-41849US	—	0.26% (18th)	—	no fix	2026-06-09	≤ 5.3.39
CVE-2026-41852US	medium5.3OT elevated	0.18% (7th)	—	7.0.8	2026-06-09	4 versions

The flaw types (CWEs) most of these CVEs share.

CWE-770Allocation of Resources Without Limits or Throttling5 CVEs
CWE-400Uncontrolled Resource Consumption2 CVEs
CWE-404Improper Resource Shutdown or Release2 CVEs
CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')2 CVEs
CWE-190Integer Overflow or Wraparound1 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-407Inefficient Algorithmic Complexity1 CVEs
CWE-863Incorrect Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.