# org.springframework.security:spring-security-config (Maven) vulnerabilities

5 known vulnerabilities (1 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 7.1.2 (Oct 22, 2026): no advisory affects it
- Newest unaffected release: 7.1.2 (Oct 22, 2026), the latest release
- Dependents: 568
- Releases: 280 since 3.0.0.RELEASE (Dec 23, 2009)
- Registry: https://central.sonatype.com/artifact/org.springframework.security/spring-security-config
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-22754: 7.0.0 to 7.0.4 (7.0.5 is outside it)
- CVE-2026-22753: 7.0.0 to 7.0.4 (7.0.5 is outside it)
- CVE-2023-34042: 5.7.9 to 5.7.10 (5.7.11 is outside it); 5.8.4 to 5.8.6 (5.8.7 is outside it); 6.0.4 to 6.0.6 (6.0.7 is outside it); 6.1.1 to 6.1.3 (6.1.4 is outside it)
- CVE-2023-34034: 5.6.0 to 5.6.11 (5.6.12 is outside it); 5.7.0 to 5.7.9 (5.7.10 is outside it); 5.8.0 to 5.8.4 (5.8.5 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it); 6.1.0 to 6.1.1 (6.1.2 is outside it)
- CVE-2023-34035: 5.8.0 to 5.8.4 (5.8.5 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it); 6.1.0 to 6.1.1 (6.1.2 is outside it)

## Advisories (5)

### [CVE-2026-22754](https://cve.now/CVE-2026-22754): ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules

- Severity: High 7.5
- Published: Apr 22, 2026
- Affected: from 7.0.0, fixed in 7.0.5.
- Fixed in 7.0.5 (released Apr 20, 2026, 2 days before disclosure).
- The latest release, 7.1.2, is not affected.

### [CVE-2026-22753](https://cve.now/CVE-2026-22753): Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers

- Severity: High 7.5
- Published: Apr 22, 2026
- Affected: from 7.0.0, fixed in 7.0.5.
- Fixed in 7.0.5 (released Apr 20, 2026, 2 days before disclosure).
- The latest release, 7.1.2, is not affected.

### [CVE-2023-34042](https://cve.now/CVE-2023-34042): The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be…

- Severity: Medium 4.1
- Published: Feb 5, 2024
- Affected: from 6.1.1, fixed in 6.1.4; from 6.0.4, fixed in 6.0.7; from 5.8.4, fixed in 5.8.7; from 5.7.9, fixed in 5.7.11.
- Fixed in 5.7.11 (released Sep 18, 2023, 140 days before disclosure), 5.8.7 (released Sep 18, 2023, 140 days before disclosure), 6.0.7 (released Sep 18, 2023, 140 days before disclosure) and 1 other version.
- The latest release, 7.1.2, is not affected.

### [CVE-2023-34034](https://cve.now/CVE-2023-34034): Using "\*\*" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and…

- Severity: Critical 9.1
- Published: Jul 19, 2023
- Affected: from 5.6.0, fixed in 5.6.12; from 5.7.0, fixed in 5.7.10; from 5.8.0, fixed in 5.8.5; from 6.0.0, fixed in 6.0.5; from 6.1.0, fixed in 6.1.2.
- Fixed in 5.6.12 (released Jul 17, 2023, 2 days before disclosure), 5.7.10 (released Jul 17, 2023, 2 days before disclosure), 5.8.5 (released Jul 17, 2023, 2 days before disclosure) and 2 other versions.
- The latest release, 7.1.2, is not affected.

### [CVE-2023-34035](https://cve.now/CVE-2023-34035): Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule…

- Severity: High 7.3
- Published: Jul 18, 2023
- Affected: from 5.8.0, fixed in 5.8.5; from 6.0.0, fixed in 6.0.5; from 6.1.0, fixed in 6.1.2.
- Fixed in 5.8.5 (released Jul 17, 2023, 1 day before disclosure), 6.0.5 (released Jul 17, 2023, 1 day before disclosure) and 6.1.2 (released Jul 17, 2023, 1 day before disclosure).
- The latest release, 7.1.2, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.springframework.security:spring-security-config
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.