{"id":"CVE-2016-5007","aliases":["CLSA-2026-1774311642","CLSA-2026-1775003159","CLSA-2026-1778028246","CLSA-2026-1781744134","CLSA-2026-1784509762","DEBIAN-CVE-2016-5007","EUVD-2018-0549","GHSA-8crv-49fr-2h6j","OESA-2021-1416","ROOT-APP-MAVEN-CVE-2016-5007","UBUNTU-CVE-2016-5007"],"status":"published","title":"Spring Security and Spring Framework may not recognize certain paths that should be protected","description":"Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02802,"percentile":0.86568,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2017-05-25T17:00:00Z","modified":"2026-11-04T09:15:03Z","fixes":[{"ecosystem":"Maven","package":"org.springframework:spring-core","fixed_in":["4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","fixed_in":["4.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","fixed_in":["3.1.1.RELEASE-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libspring-java","fixed_in":["4.3.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libspring-java","fixed_in":["4.3.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libspring-java","fixed_in":["4.3.2-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"springframework","fixed_in":["3.2.18-8.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"springframework","fixed_in":["3.2.18-8.oe1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework:spring-webmvc","fixed_in":["4.0.3.RELEASE-aikido.1","4.0.3.RELEASE-aikido.2","4.0.3.RELEASE-aikido.3","4.0.3.RELEASE-aikido.4","4.0.3.RELEASE-aikido.5","4.0.3.RELEASE-aikido.6","4.0.3.RELEASE-aikido.7","4.0.3.RELEASE-aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework:spring-core","fixed_in":["4.0.3.RELEASE-aikido.5","4.0.3.RELEASE-aikido.6","4.0.3.RELEASE-aikido.7","4.0.3.RELEASE-aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-webmvc","fixed_in":["4.0.3.RELEASE-root.io.1","4.0.3.RELEASE-root.io.2","4.0.3.RELEASE-root.io.3","4.0.3.RELEASE-root.io.4","4.0.3.RELEASE-root.io.5","4.0.3.RELEASE-root.io.6","4.0.3.RELEASE-root.io.7","4.0.3.RELEASE-root.io.8"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-core","fixed_in":["4.0.3.RELEASE-root.io.5","4.0.3.RELEASE-root.io.6","4.0.3.RELEASE-root.io.7","4.0.3.RELEASE-root.io.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.7.RELEASE"},{"fixed":"4.1.7.RELEASE-tuxcare.2"}]}],"versions":["4.1.7.RELEASE","4.1.7.RELEASE-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.7.RELEASE"},{"fixed":"4.1.7.RELEASE-tuxcare.2"}]}],"versions":["4.1.7.RELEASE","4.1.7.RELEASE-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.7.RELEASE"},{"fixed":"4.1.7.RELEASE-tuxcare.2"}]}],"versions":["4.1.7.RELEASE","4.1.7.RELEASE-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.2"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.2"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.2"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.2"}]}],"versions":["3.1.1.RELEASE","3.1.1.RELEASE-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.9.RELEASE"},{"fixed":"4.2.9.RELEASE-tuxcare.4"}]}],"versions":["4.2.9.RELEASE","4.2.9.RELEASE-tuxcare.1","4.2.9.RELEASE-tuxcare.2","4.2.9.RELEASE-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.8"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6","3.0.5.RELEASE-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"Debian:12","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1"}]}],"versions":["1.0","1.0-rc1","1.0.1","1.1","1.1-rc1","1.1-rc2","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2-rc1","1.2-rc2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","2.0","2.0-m1","2.0-m2","2.0-m3","2.0-m4","2.0-m5","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.6.SEC01","2.5.6.SEC02","2.5.6.SEC03","3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.10.RELEASE","3.2.11.RELEASE","3.2.12.RELEASE","3.2.13.RELEASE","3.2.14.RELEASE","3.2.15.RELEASE","3.2.16.RELEASE","3.2.17.RELEASE","3.2.18.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE","3.2.8.RELEASE","3.2.9.RELEASE","4.0.0.RELEASE","4.0.1.RELEASE","4.0.2.RELEASE","4.0.3.RELEASE","4.0.4.RELEASE","4.0.5.RELEASE","4.0.6.RELEASE","4.0.7.RELEASE","4.0.8.RELEASE","4.0.9.RELEASE","4.1.0.RELEASE","4.1.1.RELEASE","4.1.2.RELEASE","4.1.3.RELEASE","4.1.4.RELEASE","4.1.5.RELEASE","4.1.6.RELEASE","4.1.7.RELEASE","4.1.8.RELEASE","4.1.9.RELEASE","4.2.0.RELEASE","4.2.1.RELEASE","4.2.2.RELEASE","4.2.3.RELEASE","4.2.4.RELEASE","4.2.5.RELEASE","4.2.6.RELEASE","4.2.7.RELEASE","4.2.8.RELEASE","4.2.9.RELEASE","4.3.0.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5.RELEASE","2.0.6.RELEASE","2.0.7.RELEASE","2.0.8.RELEASE","3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.0.8.RELEASE","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.1.5.RELEASE","3.1.6.RELEASE","3.1.7.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.10.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE","3.2.8.RELEASE","3.2.9.RELEASE","4.0.0.RELEASE","4.0.1.RELEASE","4.0.2.RELEASE","4.0.3.RELEASE","4.0.4.RELEASE","4.1.0.RELEASE"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"springframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.18-8.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"springframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.18-8.oe1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3.RELEASE-aikido.1"},{"fixed":"4.0.3.RELEASE-aikido.2"},{"fixed":"4.0.3.RELEASE-aikido.3"},{"fixed":"4.0.3.RELEASE-aikido.4"},{"fixed":"4.0.3.RELEASE-aikido.5"},{"fixed":"4.0.3.RELEASE-aikido.6"},{"fixed":"4.0.3.RELEASE-aikido.7"},{"fixed":"4.0.3.RELEASE-aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3.RELEASE-aikido.5"},{"fixed":"4.0.3.RELEASE-aikido.6"},{"fixed":"4.0.3.RELEASE-aikido.7"},{"fixed":"4.0.3.RELEASE-aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3.RELEASE-root.io.1"},{"fixed":"4.0.3.RELEASE-root.io.2"},{"fixed":"4.0.3.RELEASE-root.io.3"},{"fixed":"4.0.3.RELEASE-root.io.4"},{"fixed":"4.0.3.RELEASE-root.io.5"},{"fixed":"4.0.3.RELEASE-root.io.6"},{"fixed":"4.0.3.RELEASE-root.io.7"},{"fixed":"4.0.3.RELEASE-root.io.8"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3.RELEASE-root.io.5"},{"fixed":"4.0.3.RELEASE-root.io.6"},{"fixed":"4.0.3.RELEASE-root.io.7"},{"fixed":"4.0.3.RELEASE-root.io.8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6.RELEASE-7","3.0.6.RELEASE-8","3.0.6.RELEASE-9","3.0.6.RELEASE-10","3.0.6.RELEASE-11","3.0.6.RELEASE-12","3.0.6.RELEASE-13","3.0.6.RELEASE-13ubuntu0.1~esm1","3.0.6.RELEASE-13ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13-3","3.2.13-4","3.2.13-5","3.2.13-5ubuntu0.1~esm1"]}],"products":[{"vendor":"pivotal","product":"spring framework"},{"vendor":"pivotal","product":"spring security"},{"vendor":"pivotal_software","product":"spring_framework"},{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/91687","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://pivotal.io/security/cve-2016-5007","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5007","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8crv-49fr-2h6j","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security/issues/3964","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/a30ab30e4e9ae021fdda04e9abfc228476b846b5","tags":["web"]},{"url":"https://github.com/spring-projects/spring-security/commit/e4c13e3c0ee7f06f59d3b43ca6734215ad7d8974","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5007","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1416","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-5007","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5007","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-5007","description":"Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.","status":"published","published":"2017-05-25T17:00:00Z","modified":"2024-08-06T00:46:40.202Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2018-0549","description":"Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.","status":"published","published":"2017-05-25T17:00:00Z","modified":"2024-08-06T00:46:40Z","updated_at":"2026-11-03T02:22:43.959327Z"}],"ghsa":[{"id":"GHSA-8crv-49fr-2h6j","title":"Spring Security and Spring Framework may not recognize certain paths that should be protected","description":"Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x (as well as other unsupported versions) rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.","status":"published","published":"2018-10-17T20:30:12Z","modified":"2024-03-05T17:55:32Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2016-5007","description":"Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.","status":"published","published":"2017-05-25T17:29:00.74Z","modified":"2026-06-17T00:48:36.203Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:38.290327Z"}],"osv":[{"id":"CVE-2016-5007","description":"Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.","status":"published","published":"2017-05-25T17:29:00.74Z","modified":"2026-10-24T10:30:42.285378194Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-5007","description":"Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.","status":"published","published":"2017-05-25T17:29:00.74Z","modified":"2026-09-22T07:02:59.876908936Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-8crv-49fr-2h6j","title":"Spring Security and Spring Framework may not recognize certain paths that should be protected","description":"Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x (as well as other unsupported versions) rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.","status":"published","published":"2018-10-17T20:30:12Z","modified":"2024-12-02T05:54:00.856162Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"OESA-2021-1416","title":"springframework security update","description":"The spring is based on code pubilshed in Expert One-on-One J2EE Design and Dvelopment by Rod Johnson (Wrox, 2002).it is a layered Java/J2ee application framework.\r\n\r\nSecurity Fix(es):\r\n\r\nBoth Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.(CVE-2016-5007)","status":"published","published":"2021-11-05T11:04:41Z","modified":"2026-08-18T01:16:08.137314024Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2016-5007","description":"Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.","status":"published","published":"2017-05-25T17:29:00Z","modified":"2025-09-08T16:43:46Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"CLSA-2026-1774311642","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 8 CVEs. Fixed in 4.1.7.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-11-02T19:45:03.86491648Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1775003159","title":"TuxCare security update for org.springframework (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:17Z","modified":"2026-11-02T19:45:20.464929039Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1778028246","title":"TuxCare security update for org.springframework:spring-core (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-core to address 1 CVE. Fixed in 3.1.1.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-11-02T19:45:27.320253905Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1781744134","title":"TuxCare security update for org.springframework:spring-core (2 CVEs)","description":"TuxCare rebuilt org.springframework:spring-core to address 2 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.4.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-11-02T19:45:38.166598543Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1784509762","title":"TuxCare security update for org.springframework (11 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 11 CVEs. Fixed in 3.0.5.RELEASE-tuxcare.8.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-11-02T19:45:43.461090164Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"ROOT-APP-MAVEN-CVE-2016-5007","title":"CVE-2016-5007 in org.springframework:spring-webmvc - Patched by Root","description":"Root has patched CVE-2016-5007 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-11-04T08:25:08Z","modified":"2026-11-04T09:15:03.067746563Z","updated_at":"2026-11-04T09:34:03.871859Z"}]}}