RHLW-2026-e0e5640c50ceea84
- Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-e0e5640c50ceea84.json
- Import Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-e0e5640c50ceea84.json
- JSON Data
- https://api.osv.dev/v1/vulns/RHLW-2026-e0e5640c50ceea84
- Upstream
- Published
- 2026-10-21T19:19:23Z
- Modified
- 2026-10-27T08:58:01Z
- Severity
-
- 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Lightwell Security Advisory: thymeleaf 3.0.15.RELEASE-rhlw-00009
- Details
-
Red Hat Lightwell has released org.thymeleaf:thymeleaf 3.0.15.RELEASE-rhlw-00009 with backported fixes for CVE-2026-40477, CVE-2026-40478, and CVE-2026-41901.
CVE-2026-40477: Improper restriction of the scope of accessible objects in Thymeleaf expressions
CVE-2026-40478: Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
CVE-2026-41901: Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
This patched artifact is a drop-in replacement for org.thymeleaf:thymeleaf 3.0.15.RELEASE-rhlw-00009 from Maven Central.
- References
-
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40477.json
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/security/cve/CVE-2026-40477
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40477.json
- https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr
- https://nvd.nist.gov/vuln/detail/CVE-2026-40477
- https://github.com/advisories/GHSA-r4v4-5mwr-2fwr
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40478.json
- https://access.redhat.com/security/cve/CVE-2026-40478
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40478.json
- https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79
- https://nvd.nist.gov/vuln/detail/CVE-2026-40478
- https://github.com/advisories/GHSA-xjw8-8c5c-9r79
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41901.json
- https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-c9ph-gxww-7744
- https://nvd.nist.gov/vuln/detail/CVE-2026-41901
- https://github.com/advisories/GHSA-c9ph-gxww-7744
- Credits
-
-
- Red Hat Lightwell - REMEDIATION_DEVELOPER
-
Affected packages
Red Hat Lightwell:Maven / org.thymeleaf:thymeleaf
Package
- Name
- org.thymeleaf:thymeleaf
- Purl
- pkg:maven/org.thymeleaf/thymeleaf
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.0.15.RELEASE-rhlw-00009
Affected versions
Other
m1
1.*
1.0.0-beta1
1.0.0-beta2
1.0.0-beta3
1.0.0-beta4
1.0.0-beta5
1.0.0
1.0.1
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
2.*
2.0.0-beta1
2.0.0-beta2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.20
2.0.21
2.1.0-beta1
2.1.0-beta2
2.1.0-m1
2.1.0-m2
2.1.0-m3
2.1.0.RELEASE
2.1.1.RELEASE
2.1.2.RELEASE
2.1.3.RELEASE
2.1.4.RELEASE
2.1.5.RELEASE
2.1.6.RELEASE
3.*
3.0.0.ALPHA01
3.0.0.ALPHA02
3.0.0.ALPHA03
3.0.0.BETA01
3.0.0.BETA02
3.0.0.BETA03
3.0.0.RELEASE
3.0.1.RELEASE
3.0.2.RELEASE
3.0.3.RELEASE
3.0.4.RELEASE
3.0.5.RELEASE
3.0.6.RELEASE
3.0.7.RELEASE
3.0.8.RELEASE
3.0.9.RELEASE
3.0.10.RELEASE
3.0.11.RELEASE
3.0.12.RELEASE
3.0.13.RELEASE
3.0.14.RELEASE
3.0.15.RELEASE
3.0.15.RELEASE-rhlw-00009
Database specific
lightwell
{
"backport_base_version": "3.0.15.RELEASE-rhlw-00009",
"remediated_version": "3.0.15.RELEASE-rhlw-00009",
"repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-e0e5640c50ceea84.json"