Spring Security vulnerabilities

• spring security, vmware spring security +1 more Spring Security InetAddressMatchers Incomplete Internal Network Classification CVE-2026-59277 3.7 LowAugust 27, 2026
• spring security, vmware spring security +1 more Timing Attack via Non-Constant-Time Comparison of Sensitive Values CVE-2026-59276 5.9 MediumAugust 27, 2026
• spring security, vmware spring security +1 more Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces CVE-2026-59270 Fix available 9.4 CriticalAugust 27, 2026
• spring security, vmware spring security +1 more Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) CVE-2026-47877 8.2 HighAugust 27, 2026
• spring security, vmware spring security +1 more Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation CVE-2026-47842 6.5 MediumAugust 26, 2026
• spring security, vmware spring security +1 more WebAuthn User Verification Bypass via Session Serialization CVE-2026-47841 7.4 HighAugust 26, 2026
• spring security, vmware spring security +1 more Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay CVE-2026-41707 7.4 HighAugust 25, 2026
• spring security, vmware spring security +1 more Unauthorized User Impersonation when Using X.509 Client Certificates CVE-2026-47838 Fix available 6.8 MediumJune 9, 2026
• spring security, vmware spring security +1 more Open Redirect When Using CookieRequestCache CVE-2026-41706 Fix available 6.1 MediumJune 9, 2026
• spring security, vmware spring security +1 more SAML Payloads Decrypted Without Valid Signature CVE-2026-41694 Fix available 3.7 LowJune 9, 2026
• broadcom spring authorization server, spring authorization server, security +1 more +3 more Spring Security Authorization Server Open Redirect via request_uri CVE-2026-41008 Fix available 6.1 MediumJune 9, 2026
• spring security, vmware spring security +1 more Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting CVE-2026-41003 Fix available 7.6 HighJune 9, 2026
• spring security, vmware spring security +1 more Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry CVE-2026-40993 Fix available 7.3 HighJune 9, 2026
• spring security, vmware spring security +1 more Unbounded DEFLATE Inflation in SAML 2.0 Service Provider CVE-2026-40988 Fix available 7.5 HighJune 9, 2026
• spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 more ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules CVE-2026-22754 Fix available 7.5 HighApril 22, 2026
• spring security, vmware spring security +1 more Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers CVE-2026-22753 Fix available 7.5 HighApril 22, 2026
• spring security, vmware spring security +1 more Potential Security Misconfiguration when Using withIssuerLocation CVE-2026-22748 Fix available 5.3 MediumApril 22, 2026
• spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 more Unauthorized User Impersonation when Using X.509 Client Certificates CVE-2026-22747 Public exploitFix available 6.8 MediumApril 22, 2026
• spring security, vmware spring security +1 more User Attribute Enumeration when Using DaoAuthenticationProvider CVE-2026-22746 Fix available 3.7 LowApril 22, 2026
• spring security, vmware spring security +1 more Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions CVE-2026-22751 Fix available 4.8 MediumApril 21, 2026
• spring security, vmware spring boot +1 more Authentication Bypass under Actuator CloudFoundry endpoints CVE-2026-22733 Fix available 8.2 HighMarch 19, 2026
• spring security, vmware spring security +1 more Under Some Conditions Spring Security HTTP Headers Are not Written CVE-2026-22732 Public exploitFix available 9.1 CriticalMarch 19, 2026
• spring security Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation CVE-2025-22234 Fix available 5.3 MediumJanuary 22, 2026
• spring security, vmware spring security +1 more CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types CVE-2025-41248 Fix available 7.5 HighSeptember 16, 2025
• spring security CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods CVE-2025-41232 Fix available 9.1 CriticalMay 21, 2025
• spring security Spring Security Vulnerable to Authorization Bypass via Security Annotations CVE-2025-22223 Public exploitFix available 5.3 MediumMarch 24, 2025
• spring security CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length CVE-2025-22228 Fix available 7.4 HighMarch 20, 2025
• spring security Spring Security Authorization Bypass for Case Sensitive Comparisons CVE-2024-38827 Fix available 4.8 MediumDecember 2, 2024
• spring security, vmware spring security +1 more Missing Authorization When Using @AuthorizeReturnObject CVE-2024-38810 Fix available 6.5 MediumAugust 20, 2024
• pivotal software spring security, spring security +1 more Erroneous authentication pass in Spring Security CVE-2024-22257 Fix available 8.2 HighMarch 18, 2024
• spring security, vmware spring security +1 more CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated CVE-2024-22234 Fix available 7.4 HighFebruary 20, 2024
• spring security, vmware spring security +1 more Spring Security's spring-security.xsd file is world writable CVE-2023-34042 Fix available 4.1 MediumFebruary 5, 2024
• spring security, vmware spring security +1 more Access Control Bypass in Spring Security CVE-2023-34034 Public exploitFix available 9.1 CriticalJuly 19, 2023
• spring security, vmware spring security +1 more Spring Security's authorization rules can be misconfigured when using multiple servlets CVE-2023-34035 Public exploitFix available 7.3 HighJuly 18, 2023
• spring security, vmware spring security, netapp active iq unified manager +2 more Spring Security logout not clearing security context CVE-2023-20862 Fix available 6.3 MediumApril 19, 2023
• spring security, vmware spring security, netapp active iq unified manager +2 more spring-security-oauth2-client vulnerable to Privilege Escalation CVE-2022-31690 Fix available 8.1 HighOctober 31, 2022
• spring security, vmware spring security, netapp active iq unified manager +1 more +3 more Integer overflow in BCrypt class in Spring Security CVE-2022-22976 Public exploitFix available 5.3 MediumMay 19, 2022
• spring security, vmware spring security, netapp active iq unified manager +1 more +3 more Authorization bypass in Spring Security CVE-2022-22978 Public exploitFix available EPSS 12.4% 9.8 CriticalMay 19, 2022
• pivotal spring security oauth, spring security oauth, oracle communications design studio +2 more Denial of service in Spring Security OAuth2 CVE-2022-22969 Fix available 6.5 MediumApril 21, 2022
• spring security, vmware spring security, oracle communications cloud native core policy +2 more Resource Exhaustion in Spring Security CVE-2021-22119 Public exploitFix available 7.5 HighJune 29, 2021
• pivotal software spring security, spring security, oracle communications element manager +5 more +7 more Privilege escalation in spring security CVE-2021-22112 Fix available 8.8 HighFebruary 23, 2021
• pivotal software spring security, spring security +1 more Dictionary attack with Spring Security queryable text encryptor CVE-2020-5408 Fix available 6.5 MediumMay 14, 2020
• pivotal software spring security, spring security +1 more Signature Wrapping Vulnerability with spring-security-saml2-service-provider CVE-2020-5407 Fix available 8.8 HighMay 13, 2020
• spring security, vmware spring security, debian linux +2 more PlaintextPasswordEncoder authenticates encoded passwords that are null CVE-2019-11272 Fix available 7.3 HighJune 26, 2019
• pivotal software spring security oauth, spring security oauth, oracle banking corporate lending +2 more Open Redirector in spring-security-oauth2 CVE-2019-11269 Public exploitFix available 4.2 MediumJune 12, 2019
• spring security, vmware spring security, debian linux +2 more Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security CVE-2019-3795 Fix available 3.8 LowApril 9, 2019
• pivotal software spring security oauth, spring security oauth, oracle banking corporate lending +2 more Open Redirect in spring-security-oauth2 CVE-2019-3778 Public exploitFix available EPSS 16.6% 6.5 MediumMarch 7, 2019
• spring security, vmware spring framework +1 more Authorization Bypass During JWT Issuer Validation with spring-security CVE-2018-15801 Fix available 3.3 LowDecember 19, 2018
• pivotal spring security oauth, spring security oauth +1 more Privilege Escalation in spring-security-oauth2 CVE-2018-15758 Fix available 9.6 CriticalOctober 18, 2018
• pivotal spring security oauth, spring security oauth +1 more Spring Security OAuth vulnerable to remote code execution (RCE) CVE-2018-1260 Public exploitFix available EPSS 10.6% 9.8 CriticalMay 11, 2018
• Show olderLoading…