CVE-2026-40985: Spring Web Flow EL Injection Vulnerability

CVE-2026-40985 Overview

CVE-2026-40985 affects applications that configure the WebFlowELExpressionParser in Spring Web Flow. Attackers can supply malicious Unified Expression Language (EL) expressions that the parser evaluates, leading to expression language injection [CWE-917]. The flaw impacts Spring Web Flow 4.0.0, 3.0.0 through 3.0.1, and 2.5.0 through 2.5.1.

Exploitation requires network access, user interaction, and low privileges, but successful attacks compromise confidentiality and integrity. Applications that route untrusted input into EL expressions evaluated by the parser face the greatest risk.

Critical Impact
Malicious EL expressions evaluated by WebFlowELExpressionParser can disclose sensitive data and modify application state in vulnerable Spring Web Flow deployments.

Affected Products

Spring Web Flow 4.0.0
Spring Web Flow 3.0.0 through 3.0.1
Spring Web Flow 2.5.0 through 2.5.1

Discovery Timeline

2026-06-11 - CVE-2026-40985 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-40985

Vulnerability Analysis

The vulnerability resides in WebFlowELExpressionParser, a component that parses and evaluates Unified EL expressions inside Spring Web Flow definitions. When an application wires this parser into its flow configuration, expression strings derived from request input can be interpreted as executable EL rather than data.

Unified EL supports property access, method invocation, and operator evaluation against the application's bean context. An attacker who controls expression content can therefore invoke methods on reachable beans, read sensitive attributes, or alter object state during request handling.

The issue is classified under [CWE-917], Improper Neutralization of Special Elements used in an Expression Language Statement. Impact requires user interaction, such as visiting a crafted URL, and assumes the attacker already possesses some authenticated context.

Root Cause

The root cause is the evaluation of untrusted input as Unified EL by WebFlowELExpressionParser. The parser does not sufficiently restrict the expression grammar or sandbox the evaluation context when applications route user-controlled values into expression sinks.

Attack Vector

The attack is network-based. An authenticated user must trigger the malicious flow, typically by following a crafted link or submitting a crafted form. The crafted payload contains EL syntax that the parser resolves during flow execution, reaching application beans accessible from the EL context.

No verified proof-of-concept code is published. For technical details, see the Spring Security Advisory CVE-2026-40985.

Detection Methods for CVE-2026-40985

Indicators of Compromise

Web access logs containing EL syntax such as ${...} or #{...} in query strings, form fields, or path parameters routed to Spring Web Flow endpoints.
Application logs showing unexpected bean method invocations or property lookups during flow execution.
Stack traces referencing WebFlowELExpressionParser or javax.el evaluation failures triggered by malformed payloads.

Detection Strategies

Inspect HTTP request bodies and parameters bound to flow variables for EL delimiters and reflection-related tokens.
Correlate authenticated user sessions with anomalous outbound calls or data access patterns initiated from web flow contexts.
Review dependency manifests (pom.xml, build.gradle) for Spring Web Flow versions 2.5.0–2.5.1, 3.0.0–3.0.1, or 4.0.0.

Monitoring Recommendations

Enable verbose logging on flow execution and EL evaluation failures, then forward events to a centralized SIEM for analysis.
Alert on requests containing EL metacharacters reaching endpoints backed by WebFlowELExpressionParser configurations.
Track process behavior on application servers for unexpected child processes or reflective class loading after flow requests.

How to Mitigate CVE-2026-40985

Immediate Actions Required

Inventory all applications that explicitly configure WebFlowELExpressionParser and prioritize them for patching.
Upgrade Spring Web Flow to a fixed release as identified in the Spring Security Advisory CVE-2026-40985.
Restrict access to flows that accept user-controlled values evaluated as expressions until remediation is complete.

Patch Information

Refer to the Spring Security Advisory CVE-2026-40985 for the supported upgrade path. Affected branches are 2.5.x through 2.5.1, 3.0.x through 3.0.1, and 4.0.0. Update dependency coordinates in pom.xml or build.gradle and rebuild affected services.

Workarounds

Replace WebFlowELExpressionParser with a parser that does not evaluate Unified EL on untrusted input where feasible.
Validate and reject request inputs containing EL delimiters such as ${, #{, or } before they reach flow binding.
Apply a web application firewall rule to block EL syntax targeting Spring Web Flow endpoints until upgrades are deployed.

bash

# Configuration example: enforce strict input validation at the WAF layer
# Pseudocode rule - adapt to your WAF DSL
if request.uri matches "/flow/*" and request.body matches /\$\{|#\{/ then
    block
    log "Possible CVE-2026-40985 EL injection attempt"
end