Vulnerability · Published Apr 22, 2026 · Assigned by vmware

CVE-2026-22753Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers

High 7.5

In plain English

A high-severity security flaw in Spring Security from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 83.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests.This issue affects Spring Security: from 7.0.0 through 7.0.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.springframework.security:spring-security-config	7.0.5	GHSA-4wrg-8wpc-h923

Affected products (as reported)

Vendor	Product	Versions
Spring	Spring Security	7.0.0 – through 7.0.4

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://spring.io/security/cve-2026-22753