Vulnerability · Published Mar 19, 2026 · Assigned by vmware
CVE-2026-22732Under Some Conditions Spring Security HTTP Headers Are not Written
Critical 9.1
In plain English
A critical-severity security flaw in Spring Security from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-web | no fix listed | GHSA-mf92-479x-3373 |
| Maven | org.springframework.security:spring-security-web | no fix listed | GHSA-mf92-479x-3373 |
| Maven | org.springframework.security:spring-security-web | no fix listed | GHSA-mf92-479x-3373 |
| Maven | org.springframework.security:spring-security-web | no fix listed | GHSA-mf92-479x-3373 |
| Maven | org.springframework.security:spring-security-web | 6.5.9 | GHSA-mf92-479x-3373 |
| Maven | org.springframework.security:spring-security-web | 7.0.4 | GHSA-mf92-479x-3373 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VMware | Spring Security | 5.7.0 – through 5.7.215.8.0 – through 5.8.236.3.0 – through 6.3.146.4.0 – through 6.4.146.5.0 – through 6.5.87.0.0 – through 7.0.3 |
Weakness: CWE-425 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N