{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59283.json"
      }
    ],
    "title": "org.springframework:spring-expression: Spring Framework: Safety Guard Bypass via SpEL Expression Compilation",
    "tracking": {
      "current_release_date": "2026-09-18T18:43:21+00:00",
      "generator": {
        "date": "2026-09-18T18:43:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "CVE-2026-59283",
      "initial_release_date": "2026-08-27T17:57:40.065000+00:00",
      "revision_history": [
        {
          "date": "2026-08-27T17:57:40.065000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-18T18:33:04+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-09-18T18:43:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Developer Tools and Services",
                "product": {
                  "name": "OpenShift Developer Tools and Services",
                  "product_id": "openshift_developer_tools_and_services",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ocp_tools"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenShift Developer Tools and Services"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Apache Camel 4 for Quarkus 3",
                "product": {
                  "name": "Red Hat build of Apache Camel 4 for Quarkus 3",
                  "product_id": "red_hat_build_of_apache_camel_4_for_quarkus_3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:camel_quarkus:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Apache Camel 4 for Quarkus 3"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Apache Camel - HawtIO 4",
                "product": {
                  "name": "Red Hat build of Apache Camel - HawtIO 4",
                  "product_id": "red_hat_build_of_apache_camel_-_hawtio_4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:apache_camel_hawtio:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Apache Camel - HawtIO 4"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Fuse 7",
                "product": {
                  "name": "Red Hat Fuse 7",
                  "product_id": "red_hat_fuse_7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Fuse 7"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Dev Spaces",
                "product": {
                  "name": "Red Hat OpenShift Dev Spaces",
                  "product_id": "red_hat_openshift_dev_spaces",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_devspaces:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Dev Spaces"
          },
          {
            "category": "product_version",
            "name": "jenkins.src",
            "product": {
              "name": "jenkins.src",
              "product_id": "jenkins.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/jenkins?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ocp-tools-4/jenkins-rhel8",
            "product": {
              "name": "ocp-tools-4/jenkins-rhel8",
              "product_id": "ocp-tools-4/jenkins-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/jenkins-rhel8?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ocp-tools-4/jenkins-rhel9",
            "product": {
              "name": "ocp-tools-4/jenkins-rhel9",
              "product_id": "ocp-tools-4/jenkins-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/jenkins-rhel9?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "spring-expression",
            "product": {
              "name": "spring-expression",
              "product_id": "spring-expression",
              "product_identification_helper": {
                "purl": "pkg:maven/org.springframework/spring-expression"
              }
            }
          },
          {
            "category": "product_version",
            "name": "org.apache.servicemix.bundles.spring-expression",
            "product": {
              "name": "org.apache.servicemix.bundles.spring-expression",
              "product_id": "org.apache.servicemix.bundles.spring-expression",
              "product_identification_helper": {
                "purl": "pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression"
              }
            }
          },
          {
            "category": "product_version",
            "name": "devspaces/openvsx-rhel9",
            "product": {
              "name": "devspaces/openvsx-rhel9",
              "product_id": "devspaces/openvsx-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/openvsx-rhel9?repository_url=registry.redhat.io/devspaces/openvsx-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "devspaces/pluginregistry-rhel9",
            "product": {
              "name": "devspaces/pluginregistry-rhel9",
              "product_id": "devspaces/pluginregistry-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/pluginregistry-rhel9?repository_url=registry.redhat.io/devspaces/pluginregistry-rhel9"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jenkins.src as a component of OpenShift Developer Tools and Services",
          "product_id": "openshift_developer_tools_and_services:jenkins.src"
        },
        "product_reference": "jenkins.src",
        "relates_to_product_reference": "openshift_developer_tools_and_services"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-rhel8 as a component of OpenShift Developer Tools and Services",
          "product_id": "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8"
        },
        "product_reference": "ocp-tools-4/jenkins-rhel8",
        "relates_to_product_reference": "openshift_developer_tools_and_services"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-rhel9 as a component of OpenShift Developer Tools and Services",
          "product_id": "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9"
        },
        "product_reference": "ocp-tools-4/jenkins-rhel9",
        "relates_to_product_reference": "openshift_developer_tools_and_services"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spring-expression as a component of Red Hat build of Apache Camel - HawtIO 4",
          "product_id": "red_hat_build_of_apache_camel_-_hawtio_4:spring-expression"
        },
        "product_reference": "spring-expression",
        "relates_to_product_reference": "red_hat_build_of_apache_camel_-_hawtio_4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spring-expression as a component of Red Hat build of Apache Camel 4 for Quarkus 3",
          "product_id": "red_hat_build_of_apache_camel_4_for_quarkus_3:spring-expression"
        },
        "product_reference": "spring-expression",
        "relates_to_product_reference": "red_hat_build_of_apache_camel_4_for_quarkus_3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "org.apache.servicemix.bundles.spring-expression as a component of Red Hat Fuse 7",
          "product_id": "red_hat_fuse_7:org.apache.servicemix.bundles.spring-expression"
        },
        "product_reference": "org.apache.servicemix.bundles.spring-expression",
        "relates_to_product_reference": "red_hat_fuse_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spring-expression as a component of Red Hat Fuse 7",
          "product_id": "red_hat_fuse_7:spring-expression"
        },
        "product_reference": "spring-expression",
        "relates_to_product_reference": "red_hat_fuse_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devspaces/openvsx-rhel9 as a component of Red Hat OpenShift Dev Spaces",
          "product_id": "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9"
        },
        "product_reference": "devspaces/openvsx-rhel9",
        "relates_to_product_reference": "red_hat_openshift_dev_spaces"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devspaces/pluginregistry-rhel9 as a component of Red Hat OpenShift Dev Spaces",
          "product_id": "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"
        },
        "product_reference": "devspaces/pluginregistry-rhel9",
        "relates_to_product_reference": "red_hat_openshift_dev_spaces"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-59283",
      "cwe": {
        "id": "CWE-917",
        "name": "Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')"
      },
      "discovery_date": "2026-08-27T20:14:25.753270+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2525192"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Spring Framework. Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. This could allow an attacker to circumvent security restrictions, potentially leading to unauthorized actions within the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.springframework:spring-expression: Spring Framework: Safety Guard Bypass via SpEL Expression Compilation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Spring Framework's Spring Expression Language (SpEL) execution engine. When evaluating SpEL expressions using a SimpleEvaluationContext in compiled mode, the compiler fails to maintain safety restriction checks enforced during interpreted evaluation. A remote unauthenticated attacker can exploit this bypass by supplying crafted SpEL expressions that compile at runtime, overriding restricted method and property access controls to execute arbitrary code or unauthorized actions within the application context. Default SELinux policy constraints and non-root container isolation restrict host system access, confining primary impact to the application container layer.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "openshift_developer_tools_and_services:jenkins.src",
          "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8",
          "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9",
          "red_hat_build_of_apache_camel_-_hawtio_4:spring-expression",
          "red_hat_build_of_apache_camel_4_for_quarkus_3:spring-expression",
          "red_hat_fuse_7:org.apache.servicemix.bundles.spring-expression",
          "red_hat_fuse_7:spring-expression",
          "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9",
          "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59283"
        },
        {
          "category": "external",
          "summary": "RHBZ#2525192",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525192"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59283",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59283"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59283",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59283"
        },
        {
          "category": "external",
          "summary": "https://spring.io/security/cve-2026-59283",
          "url": "https://spring.io/security/cve-2026-59283"
        }
      ],
      "release_date": "2026-08-27T17:57:40.065000+00:00",
      "remediations": [
        {
          "category": "workaround",
          "details": "Disable SpEL compilation globally by setting the system property `spring.expression.compiler.mode` or configuration bean setting to `OFF`. Alternatively, restrict SpEL expression input to trusted internal sources and avoid parsing untrusted user-supplied strings via `SimpleEvaluationContext`.",
          "product_ids": [
            "openshift_developer_tools_and_services:jenkins.src",
            "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8",
            "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9",
            "red_hat_build_of_apache_camel_-_hawtio_4:spring-expression",
            "red_hat_build_of_apache_camel_4_for_quarkus_3:spring-expression",
            "red_hat_fuse_7:org.apache.servicemix.bundles.spring-expression",
            "red_hat_fuse_7:spring-expression",
            "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9",
            "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "openshift_developer_tools_and_services:jenkins.src",
            "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8",
            "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9",
            "red_hat_build_of_apache_camel_-_hawtio_4:spring-expression",
            "red_hat_build_of_apache_camel_4_for_quarkus_3:spring-expression",
            "red_hat_fuse_7:org.apache.servicemix.bundles.spring-expression",
            "red_hat_fuse_7:spring-expression",
            "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9",
            "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openshift_developer_tools_and_services:jenkins.src",
            "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8",
            "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9",
            "red_hat_build_of_apache_camel_-_hawtio_4:spring-expression",
            "red_hat_build_of_apache_camel_4_for_quarkus_3:spring-expression",
            "red_hat_fuse_7:org.apache.servicemix.bundles.spring-expression",
            "red_hat_fuse_7:spring-expression",
            "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9",
            "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical",
          "product_ids": [
            "openshift_developer_tools_and_services:jenkins.src",
            "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8",
            "openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9",
            "red_hat_build_of_apache_camel_-_hawtio_4:spring-expression",
            "red_hat_build_of_apache_camel_4_for_quarkus_3:spring-expression",
            "red_hat_fuse_7:org.apache.servicemix.bundles.spring-expression",
            "red_hat_fuse_7:spring-expression",
            "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9",
            "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"
          ]
        }
      ],
      "title": "org.springframework:spring-expression: Spring Framework: Safety Guard Bypass via SpEL Expression Compilation"
    }
  ]
}