Spring Security HTTP Headers Are not Written Under Some Conditions

CRITICAL 9.1CVE-2026-22732 · GHSA-mf92-479x-3373 · Published 19/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
org.springframework.security:spring-security-web Maven	`≥ 5.8.0, ≤ 5.8.16≥ 6.0.0, ≤ 6.3.10≥ 6.4.0, ≤ 6.4.13≥ 6.5.0, < 6.5.9≥ 7.0.0, < 7.0.4≤ 5.7.14`	`6.5.97.0.4`
spring security vmware	`≥ 5.8.0, < 5.8.24≥ 6.3.0, < 6.3.15≥ 6.4.0, < 6.4.15≥ 6.5.0, < 6.5.9≥ 7.0.0, < 7.0.4< 5.7.22`	`5.8.246.3.156.4.156.5.97.0.45.7.22`

Description

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

NVD description

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

References

nvd.nist.gov/vuln/detail/CVE-2026-22732 · ADVISORY
spring-projects/spring-security · PACKAGE
spring.io/security/cve-2026-22732 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.springframework.security:spring-security-web

Maven

≥ 5.8.0, ≤ 5.8.16≥ 6.0.0, ≤ 6.3.10≥ 6.4.0, ≤ 6.4.13≥ 6.5.0, < 6.5.9≥ 7.0.0, < 7.0.4≤ 5.7.14

6.5.97.0.4

spring security

vmware

≥ 5.8.0, < 5.8.24≥ 6.3.0, < 6.3.15≥ 6.4.0, < 6.4.15≥ 6.5.0, < 6.5.9≥ 7.0.0, < 7.0.4< 5.7.22

5.8.246.3.156.4.156.5.97.0.45.7.22

Description

NVD description

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.