CVE-2026-40985

—

CVSS 3.1

6.4 medium

EPSS

<1%p14

Published

Jun 11, 2026 (Jun 11, 2026)

Modified

Sep 4, 2026

Description

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

Vendors: broadcom
Products: spring web flow
Weakness: CWE-917
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.