VulnerableCode Package Details - pkg:maven/org.springframework/spring-expression@5.2.6.RELEASE

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.springframework/spring-expression@5.2.6.RELEASE

Essentials
History (4)

purl	pkg:maven/org.springframework/spring-expression@5.2.6.RELEASE

Next non-vulnerable version	5.2.20
Latest non-vulnerable version	6.0.8
Risk

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-eay2-n7ub-jkg7 Aliases: CVE-2022-22950 GHSA-558x-2xjg-6232	Allocation of Resources Without Limits or Throttling in Spring Framework	5.2.20 Affected by 0 other vulnerabilities. 5.2.20.RELEASE Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 5.3.16 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 5.3.17 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-fezk-p22c-dyan Aliases: CVE-2024-38808 GHSA-9cmq-m9j5-mvww	In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.	5.3.39 Affected by 0 other vulnerabilities.
VCID-m6tq-7gmn-2kdy Aliases: CVE-2023-20863 GHSA-wxqc-pxw9-g2p8	In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.	5.2.24.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.3.27 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 6.0.8 Affected by 0 other vulnerabilities.
VCID-r8q8-2grb-7ug8 Aliases: CVE-2023-20861 GHSA-564r-hj7v-mcr5	In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.	5.2.23.RELEASE Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 5.3.26 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.0.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-12T19:37:36.465714+00:00	GitLab Importer	Affected by	VCID-fezk-p22c-dyan	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2024-38808.yml	38.6.0
2026-06-12T18:52:05.830656+00:00	GitLab Importer	Affected by	VCID-m6tq-7gmn-2kdy	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20863.yml	38.6.0
2026-06-12T18:49:48.735538+00:00	GitLab Importer	Affected by	VCID-r8q8-2grb-7ug8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20861.yml	38.6.0
2026-06-12T18:03:58.426708+00:00	GitLab Importer	Affected by	VCID-eay2-n7ub-jkg7	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2022-22950.yml	38.6.0