org.springframework.security:spring-security-web vulnerabilities (Red Hat Lightwell)

2 vulnerabilities.

• org.springframework.security:spring-security-web Red Hat Lightwell Under Some Conditions Spring Security HTTP Headers Are not Written CVE-2026-22732 Public exploitFix available 9.1 CriticalMarch 19, 2026
• org.springframework.security:spring-security-web Red Hat Lightwell Authorization Bypass of Static Resources in WebFlux Applications CVE-2024-38821 Public exploitFix available 9.1 CriticalOctober 28, 2024