Kurz gesagt
- CVE-2026-22732 ist eine Schwachstelle (KRITISCH (CVSS 9.1)) in org.springframework.security:spring-security-web, spring security (vmware).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.49%, höher als bei 42.1% aller Schwachstellen.
- Abhilfe: auf 6.5.9, 7.0.4, 5.8.24, 6.3.15 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| org.springframework.security:spring-security-web Maven | ≥ 5.8.0, ≤ 5.8.16≥ 6.0.0, ≤ 6.3.10≥ 6.4.0, ≤ 6.4.13≥ 6.5.0, < 6.5.9≥ 7.0.0, < 7.0.4≤ 5.7.14
| 6.5.97.0.4
|
| spring security | ≥ 5.8.0, < 5.8.24≥ 6.3.0, < 6.3.15≥ 6.4.0, < 6.4.15≥ 6.5.0, < 6.5.9≥ 7.0.0, < 7.0.4< 5.7.22
| 5.8.246.3.156.4.156.5.97.0.45.7.22
|
Description
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.
This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
NVD description
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.
This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:
: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
Weitere Schwachstellen in org.springframework.security:spring-security-web
Alle anzeigen →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free