thymeleaf org.thymeleaf:thymeleaf-spring6 vulnerabilities

Latest thymeleaf org.thymeleaf:thymeleaf-spring6 CVEs

Newest publication first

1. CVE-2026-40478 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

   Published 2026-04-17

   Critical·CVSS 9.1 EPSS 1.1%

   Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it f...

2. CVE-2026-40477 Improper restriction of the scope of accessible objects in Thymeleaf expressions

   Published 2026-04-17

   Critical·CVSS 9.1 EPSS 0.85%

   Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.