MavenPackage

org.springframework.security:spring-security-saml2-service-provider

4 known vulnerabilities (3 high, 1 low), with the versions each affects and the releases that fix them.

Latest release: 7.1.2 (Oct 22, 2026): no advisory affects it
Newest unaffected release: 7.1.2 (Oct 22, 2026), the latest release
Advisories: 4 · 3 high, 1 low

Dependents: 3
Releases: 186 since 5.2.0.RELEASE (Sep 30, 2019)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-41694
Affects 5.2.0.RELEASE to 5.8.16 (6.0.0 is outside it); 6.3.0 to 6.5.10 (6.5.11 is outside it); 7.0.0 to 7.0.5 (7.0.6 is outside it)
CVE-2026-41003
Affects 5.2.0.RELEASE to 5.8.16 (6.0.0 is outside it); 6.3.0 to 6.5.10 (6.5.11 is outside it); 7.0.0 to 7.0.5 (7.0.6 is outside it)
CVE-2026-40993
Affects 7.0.0 to 7.0.5 (7.0.6 is outside it)
CVE-2026-40988
Affects 5.2.0.RELEASE to 5.8.16 (6.0.0 is outside it); 6.3.0 to 6.5.10 (6.5.11 is outside it); 7.0.0 to 7.0.5 (7.0.6 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

CVE-2026-41694Low 3.7
SAML Payloads Decrypted Without Valid Signature
Affected: from 7.0.0, fixed in 7.0.6; from 6.5.0, fixed in 6.5.11; from 6.4.0, through 6.4.16; from 6.3.0, through 6.3.16; from 5.8.0, through 5.8.25; through 5.7.23.
Fixed in 6.5.11 (released Jun 9, 2026, the day of disclosure) and 7.0.6 (released Jun 9, 2026, the day of disclosure).
The latest release, 7.1.2, is not affected.
CVE-2026-41003High 7.6
Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
Affected: from 7.0.0, fixed in 7.0.6; from 6.5.0, fixed in 6.5.11; from 6.4.0, through 6.4.16; from 6.3.0, through 6.3.16; from 5.8.0, through 5.8.25; through 5.7.23.
Fixed in 6.5.11 (released Jun 9, 2026, the day of disclosure) and 7.0.6 (released Jun 9, 2026, the day of disclosure).
The latest release, 7.1.2, is not affected.
CVE-2026-40993High 7.3
Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry
Affected: from 7.0.0, fixed in 7.0.6.
Fixed in 7.0.6 (released Jun 9, 2026, the day of disclosure).
The latest release, 7.1.2, is not affected.
CVE-2026-40988High 7.5
Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
Affected: from 7.0.0, fixed in 7.0.6; from 6.5.0, fixed in 6.5.11; from 6.4.0, through 6.4.16; from 6.3.0, through 6.3.16; from 5.8.0, through 5.8.25; through 5.7.23.
Fixed in 6.5.11 (released Jun 9, 2026, the day of disclosure) and 7.0.6 (released Jun 9, 2026, the day of disclosure).
The latest release, 7.1.2, is not affected.