org.thymeleaf:thymeleaf-spring5 (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.thymeleaf:thymeleaf-spring5, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2021-43466 — CVSS 9.8 (critical): In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code…
• CVE-2026-40477 — CVSS 9.0 (critical): Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security…
• CVE-2026-40478 — CVSS 9.0 (critical): Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security…
• CVE-2026-41901 — CVSS 9.0 (critical): Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass…