CVE-2026-59283

Spring Framework does not fully enforce the safety restrictions that SimpleEvaluationContext is designed to guarantee when evaluating SpEL expressions, allowing a bypass of those guards when the SpEL expression compiler is active. The flaw is triggered in applications that evaluate expressions through SimpleEvaluationContext (the restricted context typically used for untrusted input) while the SpEL compiler, which is disabled by default, has been explicitly enabled. An attacker who can reach such an expression-evaluation path remotely and without authentication gains high integrity and availability impact to the application (CVSS 9.1; per the vector there is no confidentiality impact), because the bypass defeats the restricted context's protections. All maintained and legacy branches are listed as affected — 7.0.x, 6.2.x, 6.1.x, 6.0.x, 5.3.x, and 5.2.25.RELEASE and earlier — but only deployments that use SimpleEvaluationContext together with the compiler are actually exposed. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no confirmed exploitation is reported; EPSS estimates roughly a 0.4% chance of exploitation in the next 30 days.

What to do: Upgrade each affected deployment to a fixed release beyond the listed affected range for your branch, confirming exact fixed versions in the official VMware/Spring advisory. As a mitigation, keep the SpEL expression compiler disabled (its default state) or avoid using SimpleEvaluationContext for evaluation while the compiler is enabled until you can patch. Also audit application code paths that evaluate user-supplied SpEL expressions to determine whether this configuration applies to you.