Maven/org.thymeleaf:thymeleaf CVE-2026-40477: critical 9, EPSS 0.85%
Improper restriction of the scope of accessible objects in Thymeleaf expressions
Action: Upgrade org.thymeleaf:thymeleaf to 3.1.4.RELEASE or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.4.RELEASE | - |
Fixed versions
| 3.1.4.RELEASE |
Sources
- osv: GHSA-r4v4-5mwr-2fwr
- https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr
- https://nvd.nist.gov/vuln/detail/CVE-2026-40477
- https://github.com/thymeleaf/thymeleaf
CVE-2026-40477 · published · modified · JSON