PatchTheCVEspring security vulnerabilities and fixes
Recent CVEs affecting spring security, with upgrade or downgrade steps. 14 tracked.
Also searched as: springsecurity.
spring security has 14 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 14. Most recent: 2026-08-27. Highest priority: CVE-2026-59270 (score 47/100).
- CVE-2026-22754 HIGH 7.5 UPGRADE Vulnerability in Spring Spring Security
- CVE-2026-22753 HIGH 7.5 UPGRADE Vulnerability in Spring Spring Security
- CVE-2026-22747 MEDIUM 6.8 UPGRADE Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malfo
- CVE-2026-22746 LOW 3.7 UPGRADE Vulnerability in Spring Spring Security
- CVE-2026-22751 MEDIUM 4.8 UPGRADE Vulnerability in Spring Spring Security
- CVE-2026-22748 MEDIUM 5.3 UPGRADE Vulnerability in Spring Spring Security
- CVE-2026-41707 HIGH 7.4 UPGRADE Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPP
- CVE-2026-47841 HIGH 7.4 UPGRADE An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when usi
- CVE-2026-47842 MEDIUM 6.5 UPGRADE Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and
- CVE-2026-59277 LOW 3.7 UPGRADE Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constr
- CVE-2026-59276 MEDIUM 5.9 UPGRADE Several components in Spring Security compare security-sensitive values using standard string equality (String
- CVE-2026-47877 HIGH 8.2 UPGRADE Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity
- CVE-2026-59270 CRITICAL 9.4 UPGRADE Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrat
- CVE-2026-59354 CRITICAL 9.6 UPGRADE In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client R
FAQ
How do I fix spring security vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spring security being exploited right now?
None of the tracked spring security CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spring security CVE should I patch first?
CVE-2026-59270 currently ranks highest (47/100): Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrat.