org.thymeleaf:thymeleaf-spring6 vulnerabilities

2 known vulnerabilities in org.thymeleaf:thymeleaf-spring6 from Thymeleaf. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  thymeleaf: Improper Neutralization of Special Elements used in an Expression Language Statement

  CVE-2026-40478Apr 17, 2026ThymeleafEPSS 1.12%

  Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expres

• 9.0 Critical severity

  thymeleaf: Improper Neutralization of Special Elements used in an Expression Language Statement

  CVE-2026-40477Apr 17, 2026Thymeleaf

  Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression