Spring Security
Approved changes feed: RSS · Atom
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Vmware (7bb62c7c-2241-5a0b-8dbc-5f13251fb24e) |
|---|---|
| Product | Spring Security (38556c98-99b3-5c49-9218-a1b581c98cf7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/spring-projects/spring-security |
purl2cpe | 2026-06-01 10:12:21.421632 |
pkg:maven/org.springframework.security/spring-security-core |
purl2cpe | 2026-06-01 10:12:21.421634 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-22754 |
vulnerable | 2026-06-08 07:51:13.757565 |
ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules
HIGH (7.5)
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.
Published: 2026-04-22T05:32:48.172Z
Updated: 2026-07-15T01:19:27.274Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22753 |
vulnerable | 2026-06-08 07:51:13.757028 |
Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers
HIGH (7.5)
Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests.This issue affects Spring Security: from 7.0.0 through 7.0.4.
Published: 2026-04-22T05:20:31.083Z
Updated: 2026-04-22T15:59:59.319Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22751 |
vulnerable | 2026-06-08 07:51:13.756586 |
Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
MEDIUM (4.8)
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Published: 2026-04-21T18:30:35.428Z
Updated: 2026-04-21T18:44:34.841Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22748 |
vulnerable | 2026-06-08 07:51:13.750750 |
Potential Security Misconfiguration when Using withIssuerLocation
MEDIUM (5.3)
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Published: 2026-04-22T05:15:03.505Z
Updated: 2026-04-22T16:00:09.573Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22747 |
vulnerable | 2026-06-08 07:51:13.750349 |
Unauthorized User Impersonation when Using X.509 Client Certificates
MEDIUM (6.8)
Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
This issue affects Spring Security: from 7.0.0 through 7.0.4.
Published: 2026-04-22T05:08:41.318Z
Updated: 2026-07-15T01:19:29.723Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22746 |
vulnerable | 2026-06-08 07:51:13.749802 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22732 |
vulnerable | 2026-06-08 07:51:13.737323 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41248 |
vulnerable | 2026-06-08 07:25:06.818041 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38810 |
vulnerable | 2026-06-08 06:41:48.148816 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22234 |
vulnerable | 2026-06-08 06:29:34.185533 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34042 |
vulnerable | 2026-06-08 06:06:24.268568 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34035 |
vulnerable | 2026-06-08 06:06:24.245419 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34034 |
vulnerable | 2026-06-08 06:06:24.244598 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-20862 |
vulnerable | 2026-06-08 05:54:17.959808 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-31692 |
vulnerable | 2026-06-08 05:44:41.241072 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-31690 |
vulnerable | 2026-06-08 05:44:41.233131 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-22978 |
vulnerable | 2026-06-08 05:40:55.867014 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-22976 |
vulnerable | 2026-06-08 05:40:55.863657 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22119 |
vulnerable | 2026-06-08 05:29:59.867761 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22112 |
vulnerable | 2026-06-08 05:29:59.803710 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5408 |
vulnerable | 2026-06-08 05:26:42.793246 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-3795 |
vulnerable | 2026-06-08 05:13:56.006925 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11272 |
vulnerable | 2026-06-08 05:12:36.783529 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1199 |
vulnerable | 2026-06-08 05:11:17.178601 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-2894 |
vulnerable | 2026-06-08 04:58:09.415124 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.