En bref
- CVE-2026-22732 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant org.springframework.security:spring-security-web, spring security (vmware).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.49%, plus élevée que 42.1% des vulnérabilités.
- Correctif : mettre à jour vers 6.5.9, 7.0.4, 5.8.24, 6.3.15 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| org.springframework.security:spring-security-web Maven | ≥ 5.8.0, ≤ 5.8.16≥ 6.0.0, ≤ 6.3.10≥ 6.4.0, ≤ 6.4.13≥ 6.5.0, < 6.5.9≥ 7.0.0, < 7.0.4≤ 5.7.14
| 6.5.97.0.4
|
| spring security | ≥ 5.8.0, < 5.8.24≥ 6.3.0, < 6.3.15≥ 6.4.0, < 6.4.15≥ 6.5.0, < 6.5.9≥ 7.0.0, < 7.0.4< 5.7.22
| 5.8.246.3.156.4.156.5.97.0.45.7.22
|
Description
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.
This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
NVD description
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.
This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:
: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
Autres vulnérabilités de org.springframework.security:spring-security-web
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free