MavenPackage

org.springframework.security:spring-security-config

5 known vulnerabilities (1 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 7.1.2 (Oct 22, 2026): no advisory affects it
Newest unaffected release: 7.1.2 (Oct 22, 2026), the latest release
Advisories: 5 · 1 critical, 3 high, 1 medium

Dependents: 568
Releases: 280 since 3.0.0.RELEASE (Dec 23, 2009)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-22754
Affects 7.0.0 to 7.0.4 (7.0.5 is outside it)
CVE-2026-22753
Affects 7.0.0 to 7.0.4 (7.0.5 is outside it)
CVE-2023-34042
Affects 5.7.9 to 5.7.10 (5.7.11 is outside it); 5.8.4 to 5.8.6 (5.8.7 is outside it); 6.0.4 to 6.0.6 (6.0.7 is outside it); 6.1.1 to 6.1.3 (6.1.4 is outside it)
CVE-2023-34034
Affects 5.6.0 to 5.6.11 (5.6.12 is outside it); 5.7.0 to 5.7.9 (5.7.10 is outside it); 5.8.0 to 5.8.4 (5.8.5 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it); 6.1.0 to 6.1.1 (6.1.2 is outside it)
CVE-2023-34035
Affects 5.8.0 to 5.8.4 (5.8.5 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it); 6.1.0 to 6.1.1 (6.1.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

CVE-2026-22754High 7.5
ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules
Affected: from 7.0.0, fixed in 7.0.5.
Fixed in 7.0.5 (released Apr 20, 2026, 2 days before disclosure).
The latest release, 7.1.2, is not affected.
CVE-2026-22753High 7.5
Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers
Affected: from 7.0.0, fixed in 7.0.5.
Fixed in 7.0.5 (released Apr 20, 2026, 2 days before disclosure).
The latest release, 7.1.2, is not affected.
CVE-2023-34042Medium 4.1
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be…
Affected: from 6.1.1, fixed in 6.1.4; from 6.0.4, fixed in 6.0.7; from 5.8.4, fixed in 5.8.7; from 5.7.9, fixed in 5.7.11.
Fixed in 5.7.11 (released Sep 18, 2023, 140 days before disclosure), 5.8.7 (released Sep 18, 2023, 140 days before disclosure), 6.0.7 (released Sep 18, 2023, 140 days before disclosure) and 1 other version.
The latest release, 7.1.2, is not affected.
CVE-2023-34034Critical 9.1
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and…
Affected: from 5.6.0, fixed in 5.6.12; from 5.7.0, fixed in 5.7.10; from 5.8.0, fixed in 5.8.5; from 6.0.0, fixed in 6.0.5; from 6.1.0, fixed in 6.1.2.
Fixed in 5.6.12 (released Jul 17, 2023, 2 days before disclosure), 5.7.10 (released Jul 17, 2023, 2 days before disclosure), 5.8.5 (released Jul 17, 2023, 2 days before disclosure) and 2 other versions.
The latest release, 7.1.2, is not affected.
CVE-2023-34035High 7.3
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule…
Affected: from 5.8.0, fixed in 5.8.5; from 6.0.0, fixed in 6.0.5; from 6.1.0, fixed in 6.1.2.
Fixed in 5.8.5 (released Jul 17, 2023, 1 day before disclosure), 6.0.5 (released Jul 17, 2023, 1 day before disclosure) and 6.1.2 (released Jul 17, 2023, 1 day before disclosure).
The latest release, 7.1.2, is not affected.