CVE-2024-38821

Authorization Bypass of Static Resources in WebFlux Applications

9.1 CriticalPublic exploitFix available

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.74%Up 1.7 points since Oct 29, 2024

What each source reports

CVE List Score used9.1

Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: CVE-2024-38821
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-770
Updated: 2026-11-02

EUVDEUVD-2024-30119.1

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: EUVD-2024-3011
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c4q5-6c82-3qpw9.3

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: GHSA-c4q5-6c82-3qpw
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-285, CWE-770
Updated: 2026-11-02

NVD9.1

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: CVE-2024-38821
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-770
Updated: 2026-11-02

OSVGHSA-c4q5-6c82-3qpw9.3

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: GHSA-c4q5-6c82-3qpw
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-285, CWE-770
Updated: 2026-11-02

OSVRHLW-2026-eeb3d4215beae0d69.1

Lightwell Security Advisory: spring-security-web 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-web 5.7.11.rhlw-00006 with backported fixes for CVE-2024-38821 and CVE-2026-22732.

CVE-2026-22732: Under Some Conditions Spring Security HTTP Headers Are not Written

This patched artifact is a drop-in replacement for org.springframework.security:spring-security-web 5.7.11 from Maven Central.

Record: RHLW-2026-eeb3d4215beae0d6
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Show 21 moreShow less

OSVROOT-APP-MAVEN-CVE-2024-388219.1

CVE-2024-38821 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2024-38821 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2024-38821
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVCLSA-2026-1768349319No score

TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 6.1.6-tuxcare.1.

Record: CLSA-2026-1768349319
Updated: 2026-11-02

OSVCLSA-2026-1774398070No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.12-tuxcare.1.

Record: CLSA-2026-1774398070
Updated: 2026-11-02

OSVCLSA-2026-1774570928No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.7.11-tuxcare.1.

Record: CLSA-2026-1774570928
Updated: 2026-11-02

OSVCLSA-2026-1775435426No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 6 CVEs. Fixed in 6.2.2-tuxcare.1.

Record: CLSA-2026-1775435426
Updated: 2026-11-02

OSVCLSA-2026-1776126833No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.6.10-tuxcare.1.

Record: CLSA-2026-1776126833
Updated: 2026-11-02

OSVCLSA-2026-1785814692No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.0.8-tuxcare.1.

Record: CLSA-2026-1785814692
Updated: 2026-11-02

OSVCLSA-2026-1789676383No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 8 CVEs. Fixed in 5.8.14-tuxcare.1.

Record: CLSA-2026-1789676383
Updated: 2026-11-02

OSVCLSA-2026-1791380003No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.

Record: CLSA-2026-1791380003
Updated: 2026-11-02

OSVCLSA-2026-1791391633No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.

Record: CLSA-2026-1791391633
Updated: 2026-11-02

OSVCLSA-2026-1791392813No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.9-tuxcare.1.

Record: CLSA-2026-1791392813
Updated: 2026-11-02

OSVCLSA-2026-1792079446No score

TuxCare security update for org.springframework.security (15 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.

Record: CLSA-2026-1792079446
Updated: 2026-11-02

OSVCLSA-2026-1792089227No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.

Record: CLSA-2026-1792089227
Updated: 2026-11-02

OSVCLSA-2026-1792102802No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.

Record: CLSA-2026-1792102802
Updated: 2026-11-02

OSVCLSA-2026-1792502421No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 5.1.4.RELEASE-tuxcare.1.

Record: CLSA-2026-1792502421
Updated: 2026-11-02

OSVCLSA-2026-1792503291No score

TuxCare security update for org.springframework.security (9 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.

Record: CLSA-2026-1792503291
Updated: 2026-11-02

OSVCLSA-2026-1794175722No score

TuxCare security update for org.springframework.security (14 CVEs)

TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.6.5-tuxcare.2.

Record: CLSA-2026-1794175722
Updated: 2026-11-09

OSVCLSA-2026-1794189026No score

TuxCare security update for org.springframework.security (14 CVEs)

TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.7.6-tuxcare.2.

Record: CLSA-2026-1794189026
Updated: 2026-11-09

OSVCLSA-2026-1794244725No score

TuxCare security update for org.springframework.security (13 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.5.7-tuxcare.2.

Record: CLSA-2026-1794244725
Updated: 2026-11-10

OSVCLSA-2026-1794245422No score

TuxCare security update for org.springframework.security (13 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.6.3-tuxcare.3.

Record: CLSA-2026-1794245422
Updated: 2026-11-10

OSVCLSA-2026-1794246204No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.2.RELEASE-tuxcare.2.

Record: CLSA-2026-1794246204
Updated: 2026-11-10

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-web` Maven	5.8.0 up to 5.8.15	5.8.15
`org.springframework.security:spring-security-web` Maven	6.2.0 up to 6.2.7	6.2.7
`org.springframework.security:spring-security-web` Maven	6.0.0 up to 6.0.13	6.0.13
`org.springframework.security:spring-security-web` Maven	6.1.0 up to 6.1.11	6.1.11
`org.springframework.security:spring-security-web` Maven	6.3.0 up to 6.3.4	6.3.4
`org.springframework.security:spring-security-web` Maven	5.0.0 up to 5.7.13	5.7.13
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 4 CVEs	6.1.6 up to 6.1.6-tuxcare.1	6.1.6-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 4 CVEs	6.1.6 up to 6.1.6-tuxcare.1	6.1.6-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	5.7.12 up to 5.7.12-tuxcare.1	5.7.12-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 3 CVEs	5.7.12 up to 5.7.12-tuxcare.1	5.7.12-tuxcare.1

Show 85 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	6.0.8 up to 6.0.8-tuxcare.1	6.0.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	6.0.8 up to 6.0.8-tuxcare.1	6.0.8-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 3 CVEs	6.0.8 up to 6.0.8-tuxcare.1	6.0.8-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-config` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-config` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	5.1.2.RELEASE up to 5.1.2.RELEASE-tuxcare.2, plus listed versions 5.1.2.RELEASE-tuxcare.1	5.1.2.RELEASE-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 8 CVEs	5.1.2.RELEASE up to 5.1.2.RELEASE-tuxcare.2, plus listed versions 5.1.2.RELEASE-tuxcare.1	5.1.2.RELEASE-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 8 CVEs	5.1.2.RELEASE up to 5.1.2.RELEASE-tuxcare.2, plus listed versions 5.1.2.RELEASE-tuxcare.1	5.1.2.RELEASE-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	5.1.2.RELEASE up to 5.1.2.RELEASE-tuxcare.2, plus listed versions 5.1.2.RELEASE-tuxcare.1	5.1.2.RELEASE-tuxcare.2
`org.springframework.security:spring-security-web` Maven	5.0.0 up to 5.7.13, plus listed versions 5.0.0.RELEASE5.0.1.RELEASE5.0.10.RELEASE5.0.11.RELEASE5.0.12.RELEASE Show 45 moreShow less 5.0.13.RELEASE5.0.14.RELEASE5.0.15.RELEASE5.0.16.RELEASE5.0.17.RELEASE5.0.18.RELEASE5.0.19.RELEASE5.0.2.RELEASE5.0.3.RELEASE5.0.4.RELEASE5.0.5.RELEASE5.0.6.RELEASE5.0.7.RELEASE5.0.8.RELEASE5.0.9.RELEASE5.1.0.RELEASE5.1.1.RELEASE5.1.10.RELEASE5.1.11.RELEASE5.1.12.RELEASE5.1.13.RELEASE5.1.2.RELEASE5.1.3.RELEASE5.1.4.RELEASE5.1.5.RELEASE5.1.6.RELEASE5.1.7.RELEASE5.1.8.RELEASE5.1.9.RELEASE5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE5.2.13.RELEASE5.2.14.RELEASE5.2.15.RELEASE5.2.2.RELEASE5.2.3.RELEASE5.2.4.RELEASE5.2.5.RELEASE5.2.6.RELEASE5.2.7.RELEASE5.2.8.RELEASE5.2.9.RELEASE	5.7.13
`org.springframework.security:spring-security-web` Maven	5.8.0 up to 5.8.15, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 9 moreShow less 5.8.145.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9	5.8.15
`org.springframework.security:spring-security-web` Maven	6.2.0 up to 6.2.7, plus listed versions 6.2.16.2.26.2.36.2.46.2.56.2.6	6.2.7
`org.springframework.security:spring-security-web` Maven	6.0.0 up to 6.0.13, plus listed versions 6.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.8	6.0.13
`org.springframework.security:spring-security-web` Maven	6.1.0 up to 6.1.11, plus listed versions 6.1.16.1.26.1.36.1.46.1.5 Show 4 moreShow less 6.1.66.1.76.1.86.1.9	6.1.11
`org.springframework.security:spring-security-web` Maven	6.3.0 up to 6.3.4, plus listed versions 6.3.16.3.26.3.3	6.3.4
`org.springframework.security:spring-security-web` Red Hat Lightwell:Maven From an advisory covering 2 CVEs	before 5.7.11.rhlw-00006, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 45 moreShow less 3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE	5.7.11.rhlw-00006
`org.springframework.security:spring-security-web` Root:Maven	before 6.1.3-aikido.5	6.1.3-aikido.56.2.0-aikido.26.3.3-aikido.26.2.0-aikido.36.2.0-aikido.46.1.3-aikido.66.1.3-aikido.76.2.0-aikido.55.2.2.RELEASE-aikido.15.2.2.RELEASE-aikido.2
`io.root.org.springframework.security:spring-security-web` Root:Maven	before 6.1.3-root.io.1	6.1.3-root.io.16.1.3-root.io.46.2.0-root.io.16.3.3-root.io.16.1.3-root.io.56.2.0-root.io.26.3.3-root.io.26.2.0-root.io.36.2.0-root.io.46.1.3-root.io.66.1.3-root.io.76.2.0-root.io.55.2.2.RELEASE-root.io.15.2.2.RELEASE-root.io.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	mouadk/cve-2024-38821	2024-10-30
PoC in GitHub	masa42/CVE-2024-38821-POC	2025-01-18

History

History
Recorded	Changed	Sources
Nov 10, 2026	affected, aliases	OSV
Nov 9, 2026	affected, aliases	OSV
Nov 9, 2026	affected, aliases	OSV
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	aliases, products, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38821 is a critical vulnerability (CVSS 9.1) in Spring, published October 28, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 78th percentile. Fixed in org.springframework.security:spring-security-web 5.8.15.

References

Show 6 moreShow less

This page doesn't list everything

Left out here: 181 versions. The JSON record has them.