Spring Spring Security
29 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-59277 | 7.1.0 | Spring Security InetAddressMatchers Incomplete Internal Network Classification | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-59276 | 7.1.0 ; 7.0.0 – 7.0.6 ; 6.5.0 – 6.5.11 ; … | Timing Attack via Non-Constant-Time Comparison of Sensitive Values | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-59270 | 7.1.0 ; 7.0.0 – 7.0.6 ; 6.5.0 – 6.5.11 ; … | Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces | CRITICAL 9.4 | 0.4 % | ||
| CVE-2026-47877 | 7.1.0 ; 7.0.0 – 7.0.6 | Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) | HIGH 8.2 | 0.3 % | ||
| CVE-2026-47842 | 7.1.0 ; 7.0.0 – 7.0.6 ; 6.5.0 – 6.5.11 ; … | Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-47841 | 7.1.0 ; 7.0.0 – 7.0.6 ; 6.5.0 – 6.5.11 ; … | WebAuthn User Verification Bypass via Session Serialization | HIGH 7.4 | 0.4 % | ||
| CVE-2026-41707 | 7.1.0 ; 7.0.0 – 7.0.6 ; 6.5.0 – 6.5.11 | Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay | HIGH 7.4 | 0.4 % | ||
| CVE-2026-47838 | 5.7.0 – < 5.7.25 ; 5.8.0 – < 5.8.27 ; 6.3.0 – < 6.3.18 ; … | Unauthorized User Impersonation when Using X.509 Client Certificates | HIGH 8.1 | 0.1 % | ||
| CVE-2026-41706 | 5.7.0 – < 5.7.24 ; 5.8.0 – < 5.8.26 ; 6.3.0 – < 6.3.17 ; … | Open Redirect When Using CookieRequestCache | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-41694 | 5.7.0 – < 5.7.24 ; 5.8.0 – < 5.8.26 ; 6.3.0 – < 6.3.17 ; … | SAML Payloads Decrypted Without Valid Signature | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-41008 | 7.0.0 – < 7.0.5.1 | Spring Security Authorization Server Open Redirect via request_uri | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-41003 | 5.7.0 – < 5.7.24 ; 5.8.0 – < 5.8.26 ; 6.3.0 – < 6.3.17 ; … | Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting | HIGH 7.6 | 0.2 % | ||
| CVE-2026-40993 | 7.0.0 – < 7.0.5.1 | Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry | HIGH 7.3 | 0.2 % | ||
| CVE-2026-40988 | 5.7.0 – < 5.7.24 ; 5.8.0 – < 5.8.26 ; 6.3.0 – < 6.3.17 ; … | Unbounded DEFLATE Inflation in SAML 2.0 Service Provider | HIGH 7.5 | 0.3 % | ||
| CVE-2026-22754 | 7.0.0 – 7.0.4 | ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules | HIGH 7.5 | 0.3 % | ||
| CVE-2026-22753 | 7.0.0 – 7.0.4 | Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers | HIGH 7.5 | 0.2 % | ||
| CVE-2026-22748 | 6.3.0 – 6.3.14 ; 6.4.0 – 6.4.14 ; 6.5.0 – 6.5.9 ; … | Potential Security Misconfiguration when Using withIssuerLocation | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-22747 | 7.0.0 – 7.0.4 | Unauthorized User Impersonation when Using X.509 Client Certificates | HIGH 8.1 | 0.2 % | ||
| CVE-2026-22746 | 5.7.0 – 5.7.22 ; 5.8.0 – 5.8.24 ; 6.3.0 – 6.3.15 ; … | User Attribute Enumeration when Using DaoAuthenticationProvider | LOW 3.7 | 0.2 % | ||
| CVE-2026-22751 | 6.4.0 – 6.4.15 ; 6.5.0 – 6.5.9 ; 7.0.0 – 7.0.4 | Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions | MEDIUM 4.8 | 0.1 % | ||
| CVE-2026-22733 | 4.0.0 – 4.0.3 ; 3.5.0 – 3.5.11 ; 3.4.0 – 3.4.14 ; … | Authentication Bypass under Actuator CloudFoundry endpoints | HIGH 8.2 | 0.4 % | ||
| CVE-2025-22234 | 5.7.16 ; 5.8.18 ; 6.0.16 ; … | Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-41232 | 6.4.x – < 6.4.6 | CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods | CRITICAL 9.1 | 0.6 % | ||
| CVE-2025-22223 | 6.4.0-6.4.3 | Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an auth | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-22228 | 5.7.x – < 5.7.16 ; 5.8.x – < 5.8.18 ; 6.0.x – < 6.0.16 ; … | CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length | HIGH 7.4 | 0.6 % | ||
| CVE-2024-38810 | 6.3.x – < 6.3.2 | Missing Authorization When Using @AuthorizeReturnObject | HIGH 7.5 | 0.5 % | ||
| CVE-2024-22234 | 6.1.x – < 6.1.7 ; 6.2.x – < 6.2.2 | CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated | HIGH 7.4 | 0.7 % | ||
| CVE-2019-11272 | 4.2 – < 4.2.13.RELEASE | PlaintextPasswordEncoder authenticates encoded passwords that are null | HIGH 7.3 | 1.4 % | ||
| CVE-2019-3795 | 5.0 – < 5.0.11.RELEASE ; 5.1 – < 5.1.4.RELEASE ; 4.2 – < 4.2.11.RELEASE | Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security | MEDIUM 5.3 | 1.9 % |