Thymeleaf vulnerabilities

Products

• Thymeleaf 5
• Org.thymeleaf:thymeleaf-spring5 2
• Org.thymeleaf:thymeleaf-spring6 2

Newest

• thymeleaf Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions CVE-2026-41901 Public exploitFix available 9.0 CriticalMay 4, 2026
• thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 more Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf CVE-2026-40478 Fix available 9.1 CriticalApril 15, 2026
• thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 more Improper restriction of the scope of accessible objects in Thymeleaf expressions CVE-2026-40477 Public exploitFix available 9.1 CriticalApril 15, 2026
• codecentric spring boot admin, thymeleaf +1 more Spring-boot-admin sandbox bypass via crafted HTML CVE-2023-38286 Fix available 7.5 HighJuly 14, 2023
• thymeleaf Template injection in thymeleaf-spring5 CVE-2021-43466 Fix available 9.8 CriticalNovember 9, 2021