VulnerableCode Package Details - pkg:maven/org.springframework/spring-expression@5.3.26

Search for packages

Vulnerability	Summary	Fixed by
VCID-1bh8-3gb1-4ben Aliases: CVE-2024-38808 GHSA-9cmq-m9j5-mvww	Spring Framework vulnerable to Denial of Service In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.	5.3.39 Affected by 0 other vulnerabilities.
VCID-6ysx-5wcw-f7b5 Aliases: CVE-2023-20863 GHSA-wxqc-pxw9-g2p8	Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') In spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.	5.3.27 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 6.0.8 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-1bh8-3gb1-4ben
Aliases:
CVE-2024-38808
GHSA-9cmq-m9j5-mvww

Spring Framework vulnerable to Denial of Service In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.

5.3.39
Affected by 0 other vulnerabilities.

VCID-6ysx-5wcw-f7b5
Aliases:
CVE-2023-20863
GHSA-wxqc-pxw9-g2p8

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') In spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

5.3.27
Affected by 1 other vulnerability.

6.0.8
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-z3th-j593-m7bg	Spring Framework vulnerable to denial of service via specially crafted SpEL expression In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.	CVE-2023-20861 GHSA-564r-hj7v-mcr5

Vulnerability

Summary

Aliases

VCID-z3th-j593-m7bg

Spring Framework vulnerable to denial of service via specially crafted SpEL expression In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

CVE-2023-20861
GHSA-564r-hj7v-mcr5

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T23:06:25.675808+00:00	GitLab Importer	Affected by	VCID-1bh8-3gb1-4ben	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2024-38808.yml	38.4.0
2026-04-16T22:26:50.593331+00:00	GitLab Importer	Affected by	VCID-6ysx-5wcw-f7b5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20863.yml	38.4.0
2026-04-16T22:24:44.553409+00:00	GitLab Importer	Fixing	VCID-z3th-j593-m7bg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20861.yml	38.4.0
2026-04-12T00:24:26.372718+00:00	GitLab Importer	Affected by	VCID-1bh8-3gb1-4ben	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2024-38808.yml	38.3.0
2026-04-11T23:45:06.985631+00:00	GitLab Importer	Affected by	VCID-6ysx-5wcw-f7b5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20863.yml	38.3.0
2026-04-11T23:42:54.610318+00:00	GitLab Importer	Fixing	VCID-z3th-j593-m7bg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20861.yml	38.3.0
2026-04-03T00:32:01.961988+00:00	GitLab Importer	Affected by	VCID-1bh8-3gb1-4ben	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2024-38808.yml	38.1.0
2026-04-02T23:48:49.121926+00:00	GitLab Importer	Affected by	VCID-6ysx-5wcw-f7b5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20863.yml	38.1.0
2026-04-02T23:46:46.277274+00:00	GitLab Importer	Fixing	VCID-z3th-j593-m7bg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20861.yml	38.1.0
2026-04-02T16:59:10.681613+00:00	GHSA Importer	Fixing	VCID-z3th-j593-m7bg	https://github.com/advisories/GHSA-564r-hj7v-mcr5	38.1.0
2026-04-01T18:12:08.133739+00:00	GitLab Importer	Affected by	VCID-6ysx-5wcw-f7b5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20863.yml	38.0.0
2026-04-01T12:58:35.718864+00:00	GithubOSV Importer	Fixing	VCID-z3th-j593-m7bg	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-564r-hj7v-mcr5/GHSA-564r-hj7v-mcr5.json	38.0.0
2026-04-01T12:51:02.526373+00:00	GitLab Importer	Fixing	VCID-z3th-j593-m7bg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-expression/CVE-2023-20861.yml	38.0.0