{"id":"CVE-2026-59276","aliases":["CLSA-2026-1792063694","CLSA-2026-1792068377","CLSA-2026-1792072377","CLSA-2026-1792073875","CLSA-2026-1792077066","CLSA-2026-1792077163","CLSA-2026-1792077209","CLSA-2026-1792077256","CLSA-2026-1792077565","CLSA-2026-1792079338","CLSA-2026-1792079446","CLSA-2026-1792079757","CLSA-2026-1792080021","CLSA-2026-1792084952","CLSA-2026-1792085061","CLSA-2026-1792089227","CLSA-2026-1792089645","CLSA-2026-1792099468","CLSA-2026-1792099521","CLSA-2026-1792099598","CLSA-2026-1792099763","CLSA-2026-1792099789","CLSA-2026-1792102802","CLSA-2026-1792503291","CLSA-2026-1794175722","CLSA-2026-1794189026","CLSA-2026-1794189800","CLSA-2026-1794244725","CLSA-2026-1794245422","EUVD-2026-67168","GHSA-vj7f-9q44-g5xv"],"status":"published","title":"Timing Attack via Non-Constant-Time Comparison of Sensitive Values","description":"Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00332,"percentile":0.2666,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-208"],"published":"2026-08-27T17:57:34Z","modified":"2026-11-10T01:15:02Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.6"}]}],"versions":["6.4.13","6.4.13-tuxcare.1","6.4.13-tuxcare.2","6.4.13-tuxcare.3","6.4.13-tuxcare.4","6.4.13-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.6"}]}],"versions":["6.4.13","6.4.13-tuxcare.1","6.4.13-tuxcare.2","6.4.13-tuxcare.3","6.4.13-tuxcare.4","6.4.13-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.6"}]}],"versions":["6.4.13","6.4.13-tuxcare.1","6.4.13-tuxcare.2","6.4.13-tuxcare.3","6.4.13-tuxcare.4","6.4.13-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.6"}]}],"versions":["6.4.13","6.4.13-tuxcare.1","6.4.13-tuxcare.2","6.4.13-tuxcare.3","6.4.13-tuxcare.4","6.4.13-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.10"},{"fixed":"6.3.10-tuxcare.20"}]}],"versions":["6.3.10","6.3.10-tuxcare.1","6.3.10-tuxcare.10","6.3.10-tuxcare.11","6.3.10-tuxcare.12","6.3.10-tuxcare.13","6.3.10-tuxcare.14","6.3.10-tuxcare.15","6.3.10-tuxcare.16","6.3.10-tuxcare.17","6.3.10-tuxcare.18","6.3.10-tuxcare.19","6.3.10-tuxcare.2","6.3.10-tuxcare.3","6.3.10-tuxcare.4","6.3.10-tuxcare.5","6.3.10-tuxcare.6","6.3.10-tuxcare.7","6.3.10-tuxcare.8","6.3.10-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.10"},{"fixed":"6.3.10-tuxcare.20"}]}],"versions":["6.3.10","6.3.10-tuxcare.1","6.3.10-tuxcare.10","6.3.10-tuxcare.11","6.3.10-tuxcare.12","6.3.10-tuxcare.13","6.3.10-tuxcare.14","6.3.10-tuxcare.15","6.3.10-tuxcare.16","6.3.10-tuxcare.17","6.3.10-tuxcare.18","6.3.10-tuxcare.19","6.3.10-tuxcare.2","6.3.10-tuxcare.3","6.3.10-tuxcare.4","6.3.10-tuxcare.5","6.3.10-tuxcare.6","6.3.10-tuxcare.7","6.3.10-tuxcare.8","6.3.10-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.8"}]}],"versions":["6.2.2","6.2.2-tuxcare.1","6.2.2-tuxcare.2","6.2.2-tuxcare.3","6.2.2-tuxcare.4","6.2.2-tuxcare.5","6.2.2-tuxcare.6","6.2.2-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.8"}]}],"versions":["6.2.2","6.2.2-tuxcare.1","6.2.2-tuxcare.2","6.2.2-tuxcare.3","6.2.2-tuxcare.4","6.2.2-tuxcare.5","6.2.2-tuxcare.6","6.2.2-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.8"}]}],"versions":["6.2.2","6.2.2-tuxcare.1","6.2.2-tuxcare.2","6.2.2-tuxcare.3","6.2.2-tuxcare.4","6.2.2-tuxcare.5","6.2.2-tuxcare.6","6.2.2-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.7"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2","6.2.7-tuxcare.3","6.2.7-tuxcare.4","6.2.7-tuxcare.5","6.2.7-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.7"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2","6.2.7-tuxcare.3","6.2.7-tuxcare.4","6.2.7-tuxcare.5","6.2.7-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.7"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2","6.2.7-tuxcare.3","6.2.7-tuxcare.4","6.2.7-tuxcare.5","6.2.7-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.2"}]}],"versions":["6.3.9","6.3.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.2"}]}],"versions":["6.3.9","6.3.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.2"}]}],"versions":["6.3.9","6.3.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.5"}]}],"versions":["6.2.8","6.2.8-tuxcare.1","6.2.8-tuxcare.2","6.2.8-tuxcare.3","6.2.8-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.5"}]}],"versions":["6.2.8","6.2.8-tuxcare.1","6.2.8-tuxcare.2","6.2.8-tuxcare.3","6.2.8-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.5"}]}],"versions":["6.2.8","6.2.8-tuxcare.1","6.2.8-tuxcare.2","6.2.8-tuxcare.3","6.2.8-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.16"},{"fixed":"5.8.16-tuxcare.16"}]}],"versions":["5.8.16","5.8.16-tuxcare.10","5.8.16-tuxcare.11","5.8.16-tuxcare.12","5.8.16-tuxcare.13","5.8.16-tuxcare.14","5.8.16-tuxcare.15","5.8.16-tuxcare.4","5.8.16-tuxcare.5","5.8.16-tuxcare.6","5.8.16-tuxcare.7","5.8.16-tuxcare.8","5.8.16-tuxcare.9","5.8.16.tuxcare","5.8.16.tuxcare.1","5.8.16.tuxcare.2","5.8.16.tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.16"},{"fixed":"5.8.16-tuxcare.16"}]}],"versions":["5.8.16","5.8.16-tuxcare.10","5.8.16-tuxcare.11","5.8.16-tuxcare.12","5.8.16-tuxcare.13","5.8.16-tuxcare.14","5.8.16-tuxcare.15","5.8.16-tuxcare.4","5.8.16-tuxcare.5","5.8.16-tuxcare.6","5.8.16-tuxcare.7","5.8.16-tuxcare.8","5.8.16-tuxcare.9","5.8.16.tuxcare","5.8.16.tuxcare.1","5.8.16.tuxcare.2","5.8.16.tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.14"},{"fixed":"5.8.14-tuxcare.3"}]}],"versions":["5.8.14","5.8.14-tuxcare.1","5.8.14-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.14"},{"fixed":"5.8.14-tuxcare.3"}]}],"versions":["5.8.14","5.8.14-tuxcare.1","5.8.14-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.14"},{"fixed":"5.7.14-tuxcare.8"}]}],"versions":["5.7.14","5.7.14-tuxcare.1","5.7.14-tuxcare.2","5.7.14-tuxcare.3","5.7.14-tuxcare.4","5.7.14-tuxcare.5","5.7.14-tuxcare.6","5.7.14-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.14"},{"fixed":"5.7.14-tuxcare.8"}]}],"versions":["5.7.14","5.7.14-tuxcare.1","5.7.14-tuxcare.2","5.7.14-tuxcare.3","5.7.14-tuxcare.4","5.7.14-tuxcare.5","5.7.14-tuxcare.6","5.7.14-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.14"},{"fixed":"5.7.14-tuxcare.8"}]}],"versions":["5.7.14","5.7.14-tuxcare.1","5.7.14-tuxcare.2","5.7.14-tuxcare.3","5.7.14-tuxcare.4","5.7.14-tuxcare.5","5.7.14-tuxcare.6","5.7.14-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.7"},{"fixed":"5.7.7-tuxcare.2"}]}],"versions":["5.7.7","5.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.7"},{"fixed":"5.7.7-tuxcare.2"}]}],"versions":["5.7.7","5.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.7"},{"fixed":"5.7.7-tuxcare.2"}]}],"versions":["5.7.7","5.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.12"},{"fixed":"5.7.12-tuxcare.11"}]}],"versions":["5.7.12","5.7.12-tuxcare.1","5.7.12-tuxcare.10","5.7.12-tuxcare.2","5.7.12-tuxcare.3","5.7.12-tuxcare.4","5.7.12-tuxcare.5","5.7.12-tuxcare.6","5.7.12-tuxcare.7","5.7.12-tuxcare.8","5.7.12-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.12"},{"fixed":"5.7.12-tuxcare.11"}]}],"versions":["5.7.12","5.7.12-tuxcare.1","5.7.12-tuxcare.10","5.7.12-tuxcare.2","5.7.12-tuxcare.3","5.7.12-tuxcare.4","5.7.12-tuxcare.5","5.7.12-tuxcare.6","5.7.12-tuxcare.7","5.7.12-tuxcare.8","5.7.12-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.9"},{"fixed":"5.6.9-tuxcare.2"}]}],"versions":["5.6.9","5.6.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.9"},{"fixed":"5.6.9-tuxcare.2"}]}],"versions":["5.6.9","5.6.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.9"},{"fixed":"5.6.9-tuxcare.2"}]}],"versions":["5.6.9","5.6.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.8"},{"fixed":"5.5.8-tuxcare.2"}]}],"versions":["5.5.8","5.5.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.8"},{"fixed":"5.5.8-tuxcare.2"}]}],"versions":["5.5.8","5.5.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.8"},{"fixed":"5.5.8-tuxcare.2"}]}],"versions":["5.5.8","5.5.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.11"},{"fixed":"5.7.11-tuxcare.10"}]}],"versions":["5.7.11","5.7.11-tuxcare.1","5.7.11-tuxcare.2","5.7.11-tuxcare.3","5.7.11-tuxcare.4","5.7.11-tuxcare.5","5.7.11-tuxcare.6","5.7.11-tuxcare.7","5.7.11-tuxcare.8","5.7.11-tuxcare.9","5.7.11.tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.11"},{"fixed":"5.7.11-tuxcare.10"}]}],"versions":["5.7.11","5.7.11-tuxcare.1","5.7.11-tuxcare.2","5.7.11-tuxcare.3","5.7.11-tuxcare.4","5.7.11-tuxcare.5","5.7.11-tuxcare.6","5.7.11-tuxcare.7","5.7.11-tuxcare.8","5.7.11-tuxcare.9","5.7.11.tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13}],"products":[{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://spring.io/security/cve-2026-59276","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59276","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vj7f-9q44-g5xv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59276.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59276","title":"Timing Attack via Non-Constant-Time Comparison of Sensitive Values","description":"Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T17:57:34.993Z","modified":"2026-08-28T14:00:41.248Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-67168","description":"Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T17:57:34Z","modified":"2026-08-28T14:00:41Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:23.608347Z"}],"ghsa":[{"id":"GHSA-vj7f-9q44-g5xv","title":"Several components in Spring Security compare security-sensitive values using standard string...","description":"Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T21:31:37Z","modified":"2026-08-28T18:32:30Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:11:07.541511Z"}],"nvd":[{"id":"CVE-2026-59276","description":"Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T20:17:53.863Z","modified":"2026-09-02T16:45:37.81Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-59276","title":"Timing Attack via Non-Constant-Time Comparison of Sensitive Values","description":"Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T17:57:34.993Z","modified":"2026-10-28T02:31:04.186888509Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"CLSA-2026-1792063694","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 6.4.3-tuxcare.10.","status":"published","published":"2026-10-15T11:28:14Z","modified":"2026-11-02T19:46:28.434183651Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792068377","title":"TuxCare security update for org.springframework.security (5 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 6.4.13-tuxcare.6.","status":"published","published":"2026-10-15T12:46:17Z","modified":"2026-11-02T19:46:28.490077898Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792072377","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 6.5.11-tuxcare.3.","status":"published","published":"2026-10-15T13:52:57Z","modified":"2026-11-02T19:46:28.432973088Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792073875","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.3.10-tuxcare.20.","status":"published","published":"2026-10-15T14:17:55Z","modified":"2026-11-02T19:46:28.509517384Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077066","title":"TuxCare security update for org.springframework.security (8 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 8 CVEs. Fixed in 6.0.8-tuxcare.4.","status":"published","published":"2026-10-15T15:11:06Z","modified":"2026-11-02T19:46:28.9424175Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077163","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.2-tuxcare.8.","status":"published","published":"2026-10-15T15:12:43Z","modified":"2026-11-02T19:46:28.623455684Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077209","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.7-tuxcare.7.","status":"published","published":"2026-10-15T15:13:29Z","modified":"2026-11-02T19:46:28.620433693Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077256","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.3.9-tuxcare.2.","status":"published","published":"2026-10-15T15:14:16Z","modified":"2026-11-02T19:46:28.579558243Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077565","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.8-tuxcare.5.","status":"published","published":"2026-10-15T15:19:25Z","modified":"2026-11-02T19:46:28.960783721Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792079338","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.8.16-tuxcare.16.","status":"published","published":"2026-10-15T15:48:58Z","modified":"2026-11-02T19:46:28.628161654Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792079446","title":"TuxCare security update for org.springframework.security (15 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.","status":"published","published":"2026-10-15T15:50:46Z","modified":"2026-11-02T19:46:28.625713718Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792079757","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 6.1.6-tuxcare.8.","status":"published","published":"2026-10-15T15:55:57Z","modified":"2026-11-02T19:46:28.788534029Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792080021","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.8.14-tuxcare.3.","status":"published","published":"2026-10-15T16:00:21Z","modified":"2026-11-02T19:46:29.20204437Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792084952","title":"TuxCare security update for org.springframework.security (11 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.","status":"published","published":"2026-10-15T17:22:32Z","modified":"2026-11-02T19:46:29.285657098Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792085061","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.14-tuxcare.8.","status":"published","published":"2026-10-15T17:24:21Z","modified":"2026-11-02T19:46:29.375205234Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792089227","title":"TuxCare security update for org.springframework.security (10 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.","status":"published","published":"2026-10-15T18:33:47Z","modified":"2026-11-02T19:46:29.416522144Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792089645","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.7-tuxcare.2.","status":"published","published":"2026-10-15T18:40:45Z","modified":"2026-11-02T19:46:29.390355178Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099468","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.12-tuxcare.11.","status":"published","published":"2026-10-15T21:24:28Z","modified":"2026-11-02T19:46:29.452373192Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099521","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.6.9-tuxcare.2.","status":"published","published":"2026-10-15T21:25:21Z","modified":"2026-11-02T19:46:29.454294553Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099598","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.8.","status":"published","published":"2026-10-15T21:26:38Z","modified":"2026-11-02T19:46:29.49264102Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099763","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.5.8-tuxcare.2.","status":"published","published":"2026-10-15T21:29:23Z","modified":"2026-11-02T19:46:29.493416528Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099789","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.11-tuxcare.10.","status":"published","published":"2026-10-15T21:29:49Z","modified":"2026-11-02T19:46:29.441990695Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792102802","title":"TuxCare security update for org.springframework.security (8 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.","status":"published","published":"2026-10-15T22:20:02Z","modified":"2026-11-02T19:46:29.511023688Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792503291","title":"TuxCare security update for org.springframework.security (9 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.","status":"published","published":"2026-10-20T13:34:51Z","modified":"2026-11-02T19:46:29.887116039Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1794175722","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.6.5-tuxcare.2.","status":"published","published":"2026-11-08T23:08:43Z","modified":"2026-11-09T01:45:02.285308078Z","updated_at":"2026-11-09T02:15:19.582074Z"},{"id":"CLSA-2026-1794189026","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.7.6-tuxcare.2.","status":"published","published":"2026-11-09T02:50:27Z","modified":"2026-11-09T07:15:04.238231713Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794189800","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 7 org.springframework.security packages to address 14 CVEs. Fixed in 6.1.5-tuxcare.3.","status":"published","published":"2026-11-09T03:03:20Z","modified":"2026-11-09T07:15:04.228555714Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794244725","title":"TuxCare security update for org.springframework.security (13 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.5.7-tuxcare.2.","status":"published","published":"2026-11-09T18:18:46Z","modified":"2026-11-10T01:15:02.463817981Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794245422","title":"TuxCare security update for org.springframework.security (13 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.6.3-tuxcare.3.","status":"published","published":"2026-11-09T18:30:22Z","modified":"2026-11-10T01:15:02.483548797Z","updated_at":"2026-11-10T01:43:20.132342Z"}]}}