CVE-2026-22732
Under Some Conditions Spring Security HTTP Headers Are not Written
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:
: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Under Some Conditions Spring Security HTTP Headers Are not Written
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:
: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
- Record
CVE-2026-22732- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
EUVDEUVD-2026-13347
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:
: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
- Record
EUVD-2026-13347- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mf92-479x-3373
Spring Security HTTP Headers Are not Written Under Some Conditions
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
- Record
GHSA-mf92-479x-3373- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
NVD
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:
: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
- Record
CVE-2026-22732- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
OSV
Under Some Conditions Spring Security HTTP Headers Are not Written
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:
: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
- Record
CVE-2026-22732- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-mf92-479x-3373
Spring Security HTTP Headers Are not Written Under Some Conditions
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
- Record
GHSA-mf92-479x-3373- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
Show 25 moreShow less
OSVRHLW-2026-eeb3d4215beae0d6
Lightwell Security Advisory: spring-security-web 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-web 5.7.11.rhlw-00006 with backported fixes for CVE-2024-38821 and CVE-2026-22732.
CVE-2026-22732: Under Some Conditions Spring Security HTTP Headers Are not Written
This patched artifact is a drop-in replacement for org.springframework.security:spring-security-web 5.7.11 from Maven Central.
- Record
RHLW-2026-eeb3d4215beae0d6- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-22732
CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-22732- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1774225197 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 4.2.20.RELEASE-tuxcare.2.
- Record
CLSA-2026-1774225197- Updated
- 2026-11-02
OSVCLSA-2026-1774398059 No score
TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.14-tuxcare.1.
- Record
CLSA-2026-1774398059- Updated
- 2026-11-02
OSVCLSA-2026-1774398070 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.12-tuxcare.1.
- Record
CLSA-2026-1774398070- Updated
- 2026-11-02
OSVCLSA-2026-1774398071 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 6.1.6-tuxcare.2.
- Record
CLSA-2026-1774398071- Updated
- 2026-11-02
OSVCLSA-2026-1774484511 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 5.8.16-tuxcare.7.
- Record
CLSA-2026-1774484511- Updated
- 2026-11-02
OSVCLSA-2026-1774570928 No score
TuxCare security update for org.springframework.security (5 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.7.11-tuxcare.1.
- Record
CLSA-2026-1774570928- Updated
- 2026-11-02
OSVCLSA-2026-1775176099 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 6.3.10-tuxcare.1.
- Record
CLSA-2026-1775176099- Updated
- 2026-11-02
OSVCLSA-2026-1775435426 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 6 CVEs. Fixed in 6.2.2-tuxcare.1.
- Record
CLSA-2026-1775435426- Updated
- 2026-11-02
OSVCLSA-2026-1775694712 No score
TuxCare security update for org.springframework.security (5 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 6.4.3-tuxcare.1.
- Record
CLSA-2026-1775694712- Updated
- 2026-11-02
OSVCLSA-2026-1777336748 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 5.6.10-tuxcare.2.
- Record
CLSA-2026-1777336748- Updated
- 2026-11-02
OSVCLSA-2026-1786348732 No score
TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.7-tuxcare.2.
- Record
CLSA-2026-1786348732- Updated
- 2026-11-02
OSVCLSA-2026-1786627230 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.8-tuxcare.2.
- Record
CLSA-2026-1786627230- Updated
- 2026-11-02
OSVCLSA-2026-1787157249 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 6.4.13-tuxcare.2.
- Record
CLSA-2026-1787157249- Updated
- 2026-11-02
OSVCLSA-2026-1788804966 No score
TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.0.8-tuxcare.3.
- Record
CLSA-2026-1788804966- Updated
- 2026-11-02
OSVCLSA-2026-1790159292 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 9 CVEs. Fixed in 6.3.9-tuxcare.1.
- Record
CLSA-2026-1790159292- Updated
- 2026-11-02
OSVCLSA-2026-1791380003 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.
- Record
CLSA-2026-1791380003- Updated
- 2026-11-02
OSVCLSA-2026-1791391633 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.
- Record
CLSA-2026-1791391633- Updated
- 2026-11-02
OSVCLSA-2026-1791392813 No score
TuxCare security update for org.springframework.security (10 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.9-tuxcare.1.
- Record
CLSA-2026-1791392813- Updated
- 2026-11-02
OSVCLSA-2026-1792079446 No score
TuxCare security update for org.springframework.security (15 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.
- Record
CLSA-2026-1792079446- Updated
- 2026-11-02
OSVCLSA-2026-1792084952 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.
- Record
CLSA-2026-1792084952- Updated
- 2026-11-02
OSVCLSA-2026-1792102802 No score
TuxCare security update for org.springframework.security (8 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792102802- Updated
- 2026-11-02
OSVCLSA-2026-1792503291 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792503291- Updated
- 2026-11-02
OSVCLSA-2026-1792588191 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792588191- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-webMaven |
through 5.7.14 | None known |
org.springframework.security:spring-security-webMaven |
5.8.0 to 5.8.16 | None known |
org.springframework.security:spring-security-webMaven |
6.0.0 to 6.3.10 | None known |
org.springframework.security:spring-security-webMaven |
6.4.0 to 6.4.13 | None known |
org.springframework.security:spring-security-webMaven |
6.5.0 up to 6.5.9 | 6.5.9 |
org.springframework.security:spring-security-webMaven |
7.0.0 up to 7.0.4 | 7.0.4 |
org.springframework.security:spring-security-webTuxCare:Maven |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.2, plus listed versions 4.2.20.RELEASE-tuxcare.1 |
4.2.20.RELEASE-tuxcare.2 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 2 CVEs |
5.7.14 up to 5.7.14-tuxcare.1 | 5.7.14-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
5.7.14 up to 5.7.14-tuxcare.1 | 5.7.14-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.7.12 up to 5.7.12-tuxcare.1 | 5.7.12-tuxcare.1 |
Show 75 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
5.7.12 up to 5.7.12-tuxcare.1 | 5.7.12-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.1.6 up to 6.1.6-tuxcare.2, plus listed versions 6.1.6-tuxcare.1 |
6.1.6-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.8.16 up to 5.8.16-tuxcare.7, plus listed versions 5.8.16-tuxcare.45.8.16-tuxcare.55.8.16-tuxcare.65.8.16.tuxcare5.8.16.tuxcare.15.8.16.tuxcare.25.8.16.tuxcare.3 |
5.8.16-tuxcare.7 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 5 CVEs |
5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare |
5.7.11-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 5 CVEs |
5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare |
5.7.11-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 5 CVEs |
5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare |
5.7.11-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.3.10 up to 6.3.10-tuxcare.1 | 6.3.10-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
6.2.2 up to 6.2.2-tuxcare.1 | 6.2.2-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 6 CVEs |
6.2.2 up to 6.2.2-tuxcare.1 | 6.2.2-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
6.2.2 up to 6.2.2-tuxcare.1 | 6.2.2-tuxcare.1 |
org.springframework.security:spring-security-configTuxCare:Maven From an advisory covering 5 CVEs |
6.4.3 up to 6.4.3-tuxcare.1 | 6.4.3-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 5 CVEs |
6.4.3 up to 6.4.3-tuxcare.1 | 6.4.3-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 5 CVEs |
6.4.3 up to 6.4.3-tuxcare.1 | 6.4.3-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 5 CVEs |
6.4.3 up to 6.4.3-tuxcare.1 | 6.4.3-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.6.10 up to 5.6.10-tuxcare.2, plus listed versions 5.6.10-tuxcare.1 |
5.6.10-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 2 CVEs |
6.2.7 up to 6.2.7-tuxcare.2, plus listed versions 6.2.7-tuxcare.1 |
6.2.7-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
6.2.7 up to 6.2.7-tuxcare.2, plus listed versions 6.2.7-tuxcare.1 |
6.2.7-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 3 CVEs |
6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 |
6.2.8-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 3 CVEs |
6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 |
6.2.8-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 |
6.2.8-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 2 CVEs |
6.0.8 up to 6.0.8-tuxcare.3, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.2 |
6.0.8-tuxcare.3 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
6.0.8 up to 6.0.8-tuxcare.3, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.2 |
6.0.8-tuxcare.3 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webMaven |
through 5.7.14, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 45 moreShow less3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE |
None known |
org.springframework.security:spring-security-webMaven |
5.8.0 to 5.8.16, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 10 moreShow less5.8.145.8.155.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9 |
None known |
org.springframework.security:spring-security-webMaven |
6.0.0 to 6.3.10, plus listed versions 6.0.16.0.26.0.36.0.46.0.5 Show 32 moreShow less6.0.66.0.76.0.86.1.06.1.16.1.26.1.36.1.46.1.56.1.66.1.76.1.86.1.96.2.06.2.16.2.26.2.36.2.46.2.56.2.66.2.76.2.86.3.06.3.16.3.26.3.36.3.46.3.56.3.66.3.76.3.86.3.9 |
None known |
org.springframework.security:spring-security-webMaven |
6.4.0 to 6.4.13, plus listed versions 6.4.16.4.106.4.116.4.126.4.2 Show 7 moreShow less6.4.36.4.46.4.56.4.66.4.76.4.86.4.9 |
None known |
org.springframework.security:spring-security-webMaven |
6.5.0 up to 6.5.9, plus listed versions 6.5.16.5.26.5.36.5.46.5.56.5.66.5.76.5.8 |
6.5.9 |
org.springframework.security:spring-security-webMaven |
7.0.0 up to 7.0.4, plus listed versions 7.0.17.0.27.0.3 |
7.0.4 |
org.springframework.security:spring-security-webRed Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 5.7.11.rhlw-00006, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 45 moreShow less3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE |
5.7.11.rhlw-00006 |
org.springframework.security:spring-security-webRoot:Maven |
before 6.4.2-aikido.2 | 6.4.2-aikido.26.5.0-aikido.26.2.0-aikido.26.3.3-aikido.26.2.0-aikido.36.2.0-aikido.46.2.0-aikido.56.5.0-aikido.16.4.2-aikido.15.2.2.RELEASE-aikido.15.2.2.RELEASE-aikido.26.5.9-aikido.36.5.9-aikido.46.5.9-aikido.5 |
io.root.org.springframework.security:spring-security-webRoot:Maven |
before 6.3.3-root.io.1 | 6.3.3-root.io.16.4.2-root.io.26.5.0-root.io.26.2.0-root.io.26.3.3-root.io.26.2.0-root.io.36.2.0-root.io.46.2.0-root.io.56.5.0-root.io.16.4.2-root.io.15.2.2.RELEASE-root.io.15.2.2.RELEASE-root.io.26.5.9-root.io.36.5.9-root.io.46.5.9-root.io.5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | semgrep/cve-2026-22732-demo | 2026-04-07 |
| PoC in GitHub | moderneinc/rewrite-cve-2026-22732 | 2026-04-15 |
| PoC in GitHub | dylan-chainguard/cve-2026-22732-poc | 2026-09-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-22732 is a critical vulnerability (CVSS 9.1) in Spring Security, published March 19, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in org.springframework.security:spring-security-web 6.5.9.
References
Left out here: 242 versions. The JSON record has them.