redhat/spring-security-core vulnerabilities

Latest redhat/spring-security-core CVEs

Newest publication first

1. CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification

   Published 2026-08-27

   Medium·CVSS 5.3 EPSS 0.29%

   Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0

2. CVE-2026-59276 Timing Attack via Non-Constant-Time Comparison of Sensitive Values

   Published 2026-08-27

   Medium·CVSS 5.9 EPSS 0.33%

   Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value...

3. CVE-2026-47842 Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

   Published 2026-08-26

   Medium·CVSS 6.5 EPSS 0.15%

   Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6...

4. CVE-2026-22754 ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules

   Published 2026-04-22

   High·CVSS 7.5 EPSS 0.27%

   Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exer...

5. CVE-2026-22753 Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers

   Published 2026-04-22

   High·CVSS 7.5 EPSS 0.25%

   Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intend...

6. CVE-2026-22748 Potential Security Misconfiguration when Using withIssuerLocation

   Published 2026-04-22

   Medium·CVSS 6.5 EPSS 0.20%

   Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0...

7. CVE-2026-22747 Unauthorized User Impersonation when Using X.509 Client Certificates

   Published 2026-04-22

   High·CVSS 8.1 EPSS 0.24%

   Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonati...

8. CVE-2026-22746 User Attribute Enumeration when Using DaoAuthenticationProvider

   Published 2026-04-22

   Low·CVSS 3.7 EPSS 0.22%

   Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are...

9. CVE-2026-22751 Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions

   Published 2026-04-21

   Medium·CVSS 4.8 EPSS 0.12%

   Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 throu...

10. CVE-2026-22732 Under Some Conditions Spring Security HTTP Headers Are not Written

    Published 2026-03-19

    Critical·CVSS 9.1 EPSS 0.50%

    When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 t...

11. CVE-2025-22234 Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation

    Published 2026-01-22

    Medium·CVSS 5.3 EPSS 0.39%

    The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.