CVE-2024-38827

Spring Security Authorization Bypass for Case Sensitive Comparisons

4.8 MediumFix available

CVE-2024-38827 is a medium vulnerability (CVSS 4.8) in Spring Security, published December 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in org.springframework.security:spring-security-core 5.7.14.

What does this mean?

Severity: 4.8 MediumCVSS 3.1, CVE List
Exploit chance: 0.38%EPSS, 32nd percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 5.7.14org.springframework.security:spring-security-core +105 more

Description

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.38%Up 0.3 points since Dec 3, 2024

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-core` Maven	before 5.7.14	5.7.14
`org.springframework.security:spring-security-core` Maven	5.8.0 up to 5.8.16	5.8.16
`org.springframework.security:spring-security-core` Maven	6.0.0 up to 6.0.14	6.0.14
`org.springframework.security:spring-security-core` Maven	6.1.0 up to 6.1.12	6.1.12
`org.springframework.security:spring-security-core` Maven	6.2.0 up to 6.2.8	6.2.8
`org.springframework.security:spring-security-core` Maven	6.3.0 up to 6.3.5	6.3.5
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 4 CVEs	6.1.6 up to 6.1.6-tuxcare.1	6.1.6-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 4 CVEs	6.1.6 up to 6.1.6-tuxcare.1	6.1.6-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1

Show 96 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	5.7.12 up to 5.7.12-tuxcare.1	5.7.12-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 3 CVEs	5.7.12 up to 5.7.12-tuxcare.1	5.7.12-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-cas` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-cas` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-config` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 14 CVEs	5.6.5 up to 5.6.5-tuxcare.2, plus listed versions 5.6.5-tuxcare.1	5.6.5-tuxcare.2
`org.springframework.security:spring-security-config` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 14 CVEs	5.7.6 up to 5.7.6-tuxcare.2, plus listed versions 5.7.6-tuxcare.1	5.7.6-tuxcare.2
`org.springframework.security:spring-security-config` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2	6.1.5-tuxcare.3
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2	6.1.5-tuxcare.3
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2	6.1.5-tuxcare.3
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2	6.1.5-tuxcare.3
`org.springframework.security:spring-security-oauth2-jose` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2	6.1.5-tuxcare.3
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2	6.1.5-tuxcare.3
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2	6.1.5-tuxcare.3
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 13 CVEs	5.5.7 up to 5.5.7-tuxcare.2, plus listed versions 5.5.7-tuxcare.1	5.5.7-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 13 CVEs	5.6.3 up to 5.6.3-tuxcare.3, plus listed versions 5.6.3-tuxcare.15.6.3-tuxcare.2	5.6.3-tuxcare.3
`org.springframework.security:spring-security-core` Maven	before 5.7.14, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less 2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE	5.7.14
`org.springframework.security:spring-security-core` Maven	5.8.0 up to 5.8.16, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 10 moreShow less 5.8.145.8.155.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9	5.8.16
`org.springframework.security:spring-security-core` Maven	6.0.0 up to 6.0.14, plus listed versions 6.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.8	6.0.14
`org.springframework.security:spring-security-core` Maven	6.1.0 up to 6.1.12, plus listed versions 6.1.16.1.26.1.36.1.46.1.5 Show 4 moreShow less 6.1.66.1.76.1.86.1.9	6.1.12
`org.springframework.security:spring-security-core` Maven	6.2.0 up to 6.2.8, plus listed versions 6.2.16.2.26.2.36.2.46.2.56.2.66.2.7	6.2.8
`org.springframework.security:spring-security-core` Maven	6.3.0 up to 6.3.5, plus listed versions 6.3.16.3.26.3.36.3.4	6.3.5
`org.springframework.security:spring-security-core` Red Hat Lightwell:Maven From an advisory covering 3 CVEs	before 5.7.11.rhlw-00006, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less 2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE	5.7.11.rhlw-00006
`io.root.org.springframework.security:spring-security-core` Root:Maven	before 6.3.3-root.io.1	6.3.3-root.io.15.7.1-root.io.15.7.1-root.io.25.7.1-root.io.36.2.0-root.io.26.3.3-root.io.25.7.3-root.io.36.3.3-root.io.17814506986.2.0-root.io.35.7.3-root.io.46.2.0-root.io.46.2.0-root.io.55.7.1-root.io.45.7.3-root.io.55.7.1-root.io.5
`org.springframework.security:spring-security-core` Root:Maven	before 5.7.1-aikido.3	5.7.1-aikido.36.2.0-aikido.26.3.3-aikido.25.7.3-aikido.36.3.3-aikido.17814506986.2.0-aikido.35.7.3-aikido.46.2.0-aikido.46.2.0-aikido.55.7.1-aikido.45.7.3-aikido.55.7.1-aikido.5

What each source reports

CVE List Score used4.8

Spring Security Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: CVE-2024-38827
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2024-34964.8

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: EUVD-2024-3496
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q3v6-hm2v-pw996.3

Spring Framework has Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: GHSA-q3v6-hm2v-pw99
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

NVD4.8

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: CVE-2024-38827
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

OSVGHSA-q3v6-hm2v-pw996.3

Spring Framework has Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Record: GHSA-q3v6-hm2v-pw99
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

OSVRHLW-2026-630128d9882e951f3.7

Lightwell Security Advisory: spring-security-core 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-core 5.7.11.rhlw-00006 with backported fixes for CVE-2024-22257, CVE-2024-38827, and CVE-2026-22746.

CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider

This patched artifact is a drop-in replacement for org.springframework.security:spring-security-core 5.7.11 from Maven Central.

Record: RHLW-2026-630128d9882e951f
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Show 22 moreShow less

OSVROOT-APP-MAVEN-CVE-2024-388274.8

CVE-2024-38827 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-38827 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2024-38827
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVCLSA-2026-1768349319No score

TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 6.1.6-tuxcare.1.

Record: CLSA-2026-1768349319
Updated: 2026-11-02

OSVCLSA-2026-1773015254No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.1.

Record: CLSA-2026-1773015254
Updated: 2026-11-02

OSVCLSA-2026-1774398070No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.12-tuxcare.1.

Record: CLSA-2026-1774398070
Updated: 2026-11-02

OSVCLSA-2026-1774570928No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.7.11-tuxcare.1.

Record: CLSA-2026-1774570928
Updated: 2026-11-02

OSVCLSA-2026-1775435426No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 6 CVEs. Fixed in 6.2.2-tuxcare.1.

Record: CLSA-2026-1775435426
Updated: 2026-11-02

OSVCLSA-2026-1775694713No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 4.2.12.RELEASE-tuxcare.1.

Record: CLSA-2026-1775694713
Updated: 2026-11-02

OSVCLSA-2026-1776126833No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.6.10-tuxcare.1.

Record: CLSA-2026-1776126833
Updated: 2026-11-02

OSVCLSA-2026-1789676383No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 8 CVEs. Fixed in 5.8.14-tuxcare.1.

Record: CLSA-2026-1789676383
Updated: 2026-11-02

OSVCLSA-2026-1791380003No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.

Record: CLSA-2026-1791380003
Updated: 2026-11-02

OSVCLSA-2026-1791391633No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.

Record: CLSA-2026-1791391633
Updated: 2026-11-02

OSVCLSA-2026-1791392813No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.9-tuxcare.1.

Record: CLSA-2026-1791392813
Updated: 2026-11-02

OSVCLSA-2026-1792077066No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 8 CVEs. Fixed in 6.0.8-tuxcare.4.

Record: CLSA-2026-1792077066
Updated: 2026-11-02

OSVCLSA-2026-1792079446No score

TuxCare security update for org.springframework.security (15 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.

Record: CLSA-2026-1792079446
Updated: 2026-11-02

OSVCLSA-2026-1792084952No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.

Record: CLSA-2026-1792084952
Updated: 2026-11-02

OSVCLSA-2026-1792089227No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.

Record: CLSA-2026-1792089227
Updated: 2026-11-02

OSVCLSA-2026-1792588191No score

TuxCare security update for org.springframework.security (9 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.

Record: CLSA-2026-1792588191
Updated: 2026-11-02

OSVCLSA-2026-1794175722No score

TuxCare security update for org.springframework.security (14 CVEs)

TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.6.5-tuxcare.2.

Record: CLSA-2026-1794175722
Updated: 2026-11-09

OSVCLSA-2026-1794189026No score

TuxCare security update for org.springframework.security (14 CVEs)

TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.7.6-tuxcare.2.

Record: CLSA-2026-1794189026
Updated: 2026-11-09

OSVCLSA-2026-1794189800No score

TuxCare security update for org.springframework.security (14 CVEs)

TuxCare rebuilt 7 org.springframework.security packages to address 14 CVEs. Fixed in 6.1.5-tuxcare.3.

Record: CLSA-2026-1794189800
Updated: 2026-11-09

OSVCLSA-2026-1794244725No score

TuxCare security update for org.springframework.security (13 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.5.7-tuxcare.2.

Record: CLSA-2026-1794244725
Updated: 2026-11-10

OSVCLSA-2026-1794245422No score

TuxCare security update for org.springframework.security (13 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.6.3-tuxcare.3.

Record: CLSA-2026-1794245422
Updated: 2026-11-10

History

History
Recorded	Changed	Sources
Nov 10, 2026	affected, aliases	OSV
Nov 9, 2026	affected, aliases	OSV
Nov 9, 2026	affected, aliases	OSV
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases, products, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 7 moreShow less

This page doesn't list everything

Left out here: 260 versions. The JSON record has them.