CVE-2024-38827

Spring Security Authorization Bypass for Case Sensitive Comparisons

4.8 MediumFix available

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.38%Up 0.3 points since Dec 3, 2024

What each source reports

CVE List Score used 4.8

Spring Security Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: CVE-2024-38827
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2024-3496 4.8

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: EUVD-2024-3496
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q3v6-hm2v-pw99 6.3

Spring Framework has Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: GHSA-q3v6-hm2v-pw99
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

NVD 4.8

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: CVE-2024-38827
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

OSVGHSA-q3v6-hm2v-pw99 6.3

Spring Framework has Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: GHSA-q3v6-hm2v-pw99
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

OSVRHLW-2026-630128d9882e951f 3.7

Lightwell Security Advisory: spring-security-core 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-core 5.7.11.rhlw-00006 with backported fixes for CVE-2024-22257, CVE-2024-38827, and CVE-2026-22746.

CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider

This patched artifact is a drop-in replacement for org.springframework.security:spring-security-core 5.7.11 from Maven Central.

Record: RHLW-2026-630128d9882e951f
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Show 17 moreShow less

OSVROOT-APP-MAVEN-CVE-2024-38827 4.8

CVE-2024-38827 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-38827 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2024-38827
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVCLSA-2026-1768349319 No score

TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 6.1.6-tuxcare.1.

Record: CLSA-2026-1768349319
Updated: 2026-11-02

OSVCLSA-2026-1773015254 No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.1.

Record: CLSA-2026-1773015254
Updated: 2026-11-02

OSVCLSA-2026-1774398070 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.12-tuxcare.1.

Record: CLSA-2026-1774398070
Updated: 2026-11-02

OSVCLSA-2026-1774570928 No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.7.11-tuxcare.1.

Record: CLSA-2026-1774570928
Updated: 2026-11-02

OSVCLSA-2026-1775435426 No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 6 CVEs. Fixed in 6.2.2-tuxcare.1.

Record: CLSA-2026-1775435426
Updated: 2026-11-02

OSVCLSA-2026-1775694713 No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 4.2.12.RELEASE-tuxcare.1.

Record: CLSA-2026-1775694713
Updated: 2026-11-02

OSVCLSA-2026-1776126833 No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.6.10-tuxcare.1.

Record: CLSA-2026-1776126833
Updated: 2026-11-02

OSVCLSA-2026-1789676383 No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 8 CVEs. Fixed in 5.8.14-tuxcare.1.

Record: CLSA-2026-1789676383
Updated: 2026-11-02

OSVCLSA-2026-1791380003 No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.

Record: CLSA-2026-1791380003
Updated: 2026-11-02

OSVCLSA-2026-1791391633 No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.

Record: CLSA-2026-1791391633
Updated: 2026-11-02

OSVCLSA-2026-1791392813 No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.9-tuxcare.1.

Record: CLSA-2026-1791392813
Updated: 2026-11-02

OSVCLSA-2026-1792077066 No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 8 CVEs. Fixed in 6.0.8-tuxcare.4.

Record: CLSA-2026-1792077066
Updated: 2026-11-02

OSVCLSA-2026-1792079446 No score

TuxCare security update for org.springframework.security (15 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.

Record: CLSA-2026-1792079446
Updated: 2026-11-02

OSVCLSA-2026-1792084952 No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.

Record: CLSA-2026-1792084952
Updated: 2026-11-02

OSVCLSA-2026-1792089227 No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.

Record: CLSA-2026-1792089227
Updated: 2026-11-02

OSVCLSA-2026-1792588191 No score

TuxCare security update for org.springframework.security (9 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.

Record: CLSA-2026-1792588191
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-core` Maven	before 5.7.14	5.7.14
`org.springframework.security:spring-security-core` Maven	5.8.0 up to 5.8.16	5.8.16
`org.springframework.security:spring-security-core` Maven	6.0.0 up to 6.0.14	6.0.14
`org.springframework.security:spring-security-core` Maven	6.1.0 up to 6.1.12	6.1.12
`org.springframework.security:spring-security-core` Maven	6.2.0 up to 6.2.8	6.2.8
`org.springframework.security:spring-security-core` Maven	6.3.0 up to 6.3.5	6.3.5
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 4 CVEs	6.1.6 up to 6.1.6-tuxcare.1	6.1.6-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 4 CVEs	6.1.6 up to 6.1.6-tuxcare.1	6.1.6-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1

Show 67 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	5.7.12 up to 5.7.12-tuxcare.1	5.7.12-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 3 CVEs	5.7.12 up to 5.7.12-tuxcare.1	5.7.12-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-cas` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-cas` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` Maven	before 5.7.14, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less 2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE	5.7.14
`org.springframework.security:spring-security-core` Maven	5.8.0 up to 5.8.16, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 10 moreShow less 5.8.145.8.155.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9	5.8.16
`org.springframework.security:spring-security-core` Maven	6.0.0 up to 6.0.14, plus listed versions 6.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.8	6.0.14
`org.springframework.security:spring-security-core` Maven	6.1.0 up to 6.1.12, plus listed versions 6.1.16.1.26.1.36.1.46.1.5 Show 4 moreShow less 6.1.66.1.76.1.86.1.9	6.1.12
`org.springframework.security:spring-security-core` Maven	6.2.0 up to 6.2.8, plus listed versions 6.2.16.2.26.2.36.2.46.2.56.2.66.2.7	6.2.8
`org.springframework.security:spring-security-core` Maven	6.3.0 up to 6.3.5, plus listed versions 6.3.16.3.26.3.36.3.4	6.3.5
`org.springframework.security:spring-security-core` Red Hat Lightwell:Maven From an advisory covering 3 CVEs	before 5.7.11.rhlw-00006, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less 2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE	5.7.11.rhlw-00006
`io.root.org.springframework.security:spring-security-core` Root:Maven	before 6.3.3-root.io.1	6.3.3-root.io.15.7.1-root.io.15.7.1-root.io.25.7.1-root.io.36.2.0-root.io.26.3.3-root.io.25.7.3-root.io.36.3.3-root.io.17814506986.2.0-root.io.35.7.3-root.io.46.2.0-root.io.46.2.0-root.io.55.7.1-root.io.45.7.3-root.io.55.7.1-root.io.5
`org.springframework.security:spring-security-core` Root:Maven	before 5.7.1-aikido.3	5.7.1-aikido.36.2.0-aikido.26.3.3-aikido.25.7.3-aikido.36.3.3-aikido.17814506986.2.0-aikido.35.7.3-aikido.46.2.0-aikido.46.2.0-aikido.55.7.1-aikido.45.7.3-aikido.55.7.1-aikido.5

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases, products, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38827 is a medium vulnerability (CVSS 4.8) in Spring Security, published December 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in org.springframework.security:spring-security-core 5.7.14.

References

Show 7 moreShow less

This page doesn't list everything

Left out here: 260 versions. The JSON record has them.