CVE-2026-41901
3 advisories.
Maven/org.thymeleaf:thymeleaf CVE-2026-41901: critical 9
Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns
Action: Upgrade org.thymeleaf:thymeleaf to 3.1.5.RELEASE or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.5.RELEASE | - |
Fixed versions
| 3.1.5.RELEASE |
Sources
- osv: GHSA-c9ph-gxww-7744
- https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-c9ph-gxww-7744
- https://nvd.nist.gov/vuln/detail/CVE-2026-41901
- https://github.com/thymeleaf/thymeleaf
CVE-2026-41901 · published · modified · JSON
Maven/org.thymeleaf:thymeleaf-spring5 CVE-2026-41901: critical 9
Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns
Action: Upgrade org.thymeleaf:thymeleaf-spring5 to 3.1.5.RELEASE or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.5.RELEASE | - |
Fixed versions
| 3.1.5.RELEASE |
Sources
- osv: GHSA-c9ph-gxww-7744#Maven/org.thymeleaf:thymeleaf-spring5
- https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-c9ph-gxww-7744
- https://nvd.nist.gov/vuln/detail/CVE-2026-41901
- https://github.com/thymeleaf/thymeleaf
CVE-2026-41901 · published · modified · JSON
Maven/org.thymeleaf:thymeleaf-spring6 CVE-2026-41901: critical 9
Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns
Action: Upgrade org.thymeleaf:thymeleaf-spring6 to 3.1.5.RELEASE or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.5.RELEASE | - |
Fixed versions
| 3.1.5.RELEASE |
Sources
- osv: GHSA-c9ph-gxww-7744#Maven/org.thymeleaf:thymeleaf-spring6
- https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-c9ph-gxww-7744
- https://nvd.nist.gov/vuln/detail/CVE-2026-41901
- https://github.com/thymeleaf/thymeleaf
CVE-2026-41901 · published · modified · JSON