What is the CVSS score of EUVD-2026-35340?

EUVD-2026-35340 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-35340?

Yes, a patch is available for EUVD-2026-35340. Update the affected software to the latest version immediately.

Spring Framework EUVD-2026-35340

| CVE-2026-41852 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-09 vmware

GHSA-9f52-rjqv-25qv

Authentication Bypass Java Spring Framework Red Hat

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Red Hat

3.7 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 11, 2026 - 15:52 NVD

LOW MEDIUM

CVSS changed

Jun 11, 2026 - 15:52 NVD

3.7 (LOW) 5.3 (MEDIUM)

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:22 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

282 maven packages depend on org.springframework:spring-expression (9 direct, 273 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

AnalysisAI

Spring Expression Language (SpEL) evaluation logic in Spring Framework 5.3.x through 7.0.x fails to enforce method invocation restrictions in read-only or restricted contexts, allowing remote unauthenticated attackers (CVSS PR:N, AV:N) to invoke arbitrary zero-argument methods and trigger unintended application logic. Scored LOW (3.7) with only availability impact per CVSS (A:L), though the 'Authentication Bypass' tag and CWE-863 (Incorrect Authorization) suggest the authorization bypass itself may have broader implications not fully reflected in the score. No public exploit identified at time of analysis and no CISA KEV listing, but the wide version range across four active Spring Framework release trains represents significant ecosystem exposure.

Technical ContextAI

Spring Expression Language (SpEL) is Spring Framework's runtime expression language used to query and manipulate object graphs, supporting data binding, security expressions, configuration, and query processing. The vulnerability is rooted in CWE-863 (Incorrect Authorization): the evaluation engine is supposed to apply stricter method invocation controls when operating in a restricted or read-only context - such as when applications use SimpleEvaluationContext instead of the full StandardEvaluationContext - but the logic incorrectly permits zero-argument method calls to bypass these controls. The affected CPE is cpe:2.3:a:spring:spring_framework:*:*:*:*:*:*:*:*, spanning all platforms (Java). Applications that pipe user-controlled or external data into SpEL evaluation while relying on restricted context configurations for safety are the primary exposure surface.

RemediationAI

Upgrade Spring Framework to the first version beyond each affected range: 7.0.8 or later for the 7.0.x train, 6.2.19 or later for the 6.2.x train, 6.1.28 or later for the 6.1.x train, and 5.3.49 or later for the 5.3.x train - however, these exact patch versions are inferred from the stated affected ranges and are not independently confirmed from the available input data; consult the vendor advisory at https://spring.io/security/cve-2026-41852 for the definitive fixed releases. As an immediate compensating control, audit all application code for SpEL evaluation that accepts external or user-controlled input and enforce explicit method and property resolver restrictions via SimpleEvaluationContext with a custom MethodResolver that whitelists only intended operations - note that this is a defense-in-depth measure and does not substitute for patching. Avoid using StandardEvaluationContext with untrusted input, as that context was never designed to be safe for external data. Applications that do not expose SpEL evaluation to user-controlled input are not affected and do not require emergency remediation.