PatchTheCVE: spring security

CVE-2026-59277: Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constr

Wed, 02 Sep 2026 16:57:37 +0000

LOW 3.7: Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0

CVE-2026-59276: Several components in Spring Security compare security-sensitive values using standard string equality (String

Wed, 02 Sep 2026 16:45:37 +0000

MEDIUM 5.9: Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to t

CVE-2026-59354: In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client R

Tue, 01 Sep 2026 16:01:32 +0000

CRITICAL 9.6: In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses

CVE-2026-59270: Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrat

Tue, 01 Sep 2026 20:36:33 +0000

CRITICAL 9.4: Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 S

CVE-2026-47877: Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity

Wed, 02 Sep 2026 15:23:27 +0000

HIGH 8.2: Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

CVE-2026-47842: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and

Fri, 04 Sep 2026 19:34:25 +0000

MEDIUM 6.5: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring

CVE-2026-47841: An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when usi

Fri, 04 Sep 2026 19:41:48 +0000

HIGH 7.4: An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18

CVE-2026-41707: Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPP

Thu, 24 Sep 2026 14:27:30 +0000

HIGH 7.4: Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by

CVE-2026-22754: Vulnerability in Spring Spring Security

Mon, 26 Oct 2026 22:10:00 +0000

HIGH 7.5: Vulnerability in Spring Spring Security. If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead

CVE-2026-22753: Vulnerability in Spring Spring Security

Mon, 26 Oct 2026 22:10:00 +0000

HIGH 7.5: Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the applicatio

CVE-2026-22748: Vulnerability in Spring Spring Security

Mon, 26 Oct 2026 21:10:00 +0000

MEDIUM 5.3: Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, fr

CVE-2026-22747: Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malfo

Mon, 26 Oct 2026 22:10:00 +0000

MEDIUM 6.8: Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Thi

CVE-2026-22746: Vulnerability in Spring Spring Security

Mon, 26 Oct 2026 22:10:00 +0000

LOW 3.7: Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, o

CVE-2026-22751: Vulnerability in Spring Spring Security

Mon, 26 Oct 2026 21:10:00 +0000

MEDIUM 4.8: Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0