CVE-2026-59283: CWE-913 Improper Control of Dynamically-Managed Code Resources in Spring Spring Framework

This vulnerability (CWE-913) affects applications that evaluate SpEL expressions using SimpleEvaluationContext in the Spring Framework versions 5.2.25.RELEASE and earlier up to 7.0.8. When the SpEL expression compiler is active, it may allow bypassing safety guards designed to control dynamically-managed code resources. The CVSS v3.1 score is 9.1 (critical), indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact. No official patch or remediation level is currently provided by the vendor, and no known exploits in the wild have been reported.

The vulnerability allows attackers to bypass safety mechanisms in SpEL expression evaluation, potentially leading to unauthorized modification or disruption of application behavior. The impact affects integrity and availability, which could result in compromised application logic or denial of service conditions. Confidentiality is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the SpEL expression compiler or avoid using SimpleEvaluationContext for evaluating SpEL expressions if feasible. Monitor vendor communications for updates on patches or official mitigations.