Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework.security:spring-security-web

7 known vulnerabilities (2 critical, 3 medium), with the versions each affects and the releases that fix them.

Latest release
7.1.2 (Oct 22, 2026): no advisory affects it
Newest unaffected release
7.1.2 (Oct 22, 2026), the latest release
Advisories
7 · 2 critical, 3 medium
Dependents
644
Releases
280 since 3.0.0.RELEASE (Dec 23, 2009)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-47838
    Affects 3.0.0.RELEASE to 6.5.10 (6.5.11 is outside it)
  • CVE-2026-41706
    Affects 3.0.0.RELEASE to 5.8.16 (6.0.0 is outside it); 6.3.0 to 6.3.10 (6.4.0 is outside it); 6.5.0 to 6.5.10 (6.5.11 is outside it); 7.0.0 to 7.0.5 (7.0.6 is outside it)
  • CVE-2026-22747
    Affects 7.0.0 to 7.0.4 (7.0.5 is outside it)
  • CVE-2026-22732
    Affects 3.0.0.RELEASE to 6.5.8 (6.5.9 is outside it); 7.0.0 to 7.0.3 (7.0.4 is outside it)
  • CVE-2024-38821
    Affects 5.0.0.RELEASE to 5.7.12 (5.7.13 is outside it); 5.8.0 to 5.8.14 (5.8.15 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it); 6.3.0 to 6.3.3 (6.3.4 is outside it)
  • CVE-2022-22978
    Affects 3.0.0.RELEASE to 5.4.10 (5.4.11 is outside it); 5.5.0 to 5.5.6 (5.5.7 is outside it); 5.6.0 to 5.6.3 (5.6.4 is outside it)
  • CVE-2021-22112
    Affects 3.0.0.RELEASE to 5.2.8.RELEASE (5.2.9.RELEASE is outside it); 5.3.0.RELEASE to 5.3.7.RELEASE (5.3.8.RELEASE is outside it); 5.4.0 to 5.4.3 (5.4.4 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

  • CVE-2026-47838Medium 6.8

    Unauthorized User Impersonation when Using X.509 Client Certificates

    Affected: from 6.5.0, fixed in 6.5.11; from 6.4.0, through 6.4.13; from 6.0.0, through 6.3.10; from 5.8.0, through 5.8.16; through 5.7.14.

    Fixed in 6.5.11 (released Jun 9, 2026, the day of disclosure).

    The latest release, 7.1.2, is not affected.

  • CVE-2026-41706Medium 6.1

    Open Redirect When Using CookieRequestCache

    Affected: from 7.0.0, fixed in 7.0.6; from 6.5.0, fixed in 6.5.11; from 6.3.0, through 6.3.16; from 5.8.0, through 5.8.25; through 5.7.23.

    Fixed in 6.5.11 (released Jun 9, 2026, the day of disclosure) and 7.0.6 (released Jun 9, 2026, the day of disclosure).

    The latest release, 7.1.2, is not affected.

  • CVE-2026-22747Medium 6.8

    Unauthorized User Impersonation when Using X.509 Client Certificates

    Affected: from 7.0.0, fixed in 7.0.5.

    Fixed in 7.0.5 (released Apr 20, 2026, 2 days before disclosure).

    The latest release, 7.1.2, is not affected.

  • CVE-2026-22732Critical 9.1

    Under Some Conditions Spring Security HTTP Headers Are not Written

    Affected: through 5.7.14; from 5.8.0, through 5.8.16; from 6.0.0, through 6.3.10; from 6.4.0, through 6.4.13; from 6.5.0, fixed in 6.5.9; from 7.0.0, fixed in 7.0.4.

    Fixed in 6.5.9 (released Mar 16, 2026, 3 days before disclosure) and 7.0.4 (released Mar 16, 2026, 3 days before disclosure).

    The latest release, 7.1.2, is not affected.

  • CVE-2024-38821Critical 9.1

    Authorization Bypass of Static Resources in WebFlux Applications

    Affected: from 5.0.0, fixed in 5.7.13; from 5.8.0, fixed in 5.8.15; from 6.2.0, fixed in 6.2.7; from 6.0.0, fixed in 6.0.13; from 6.1.0, fixed in 6.1.11; from 6.3.0, fixed in 6.3.4.

    Fixed in 5.7.13 (released Oct 21, 2024, 7 days before disclosure), 5.8.15 (released Oct 21, 2024, 7 days before disclosure), 6.2.7 (released Oct 21, 2024, 7 days before disclosure, the advisory names 6.0.13, which was never published) and 1 other version.

    The latest release, 7.1.2, is not affected.

  • In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be…

    Affected: from 5.5.0, fixed in 5.5.7; from 5.6.0, fixed in 5.6.4; fixed in 5.4.11.

    Fixed in 5.4.11 (released Mar 20, 2023, 305 days after disclosure), 5.5.7 (released May 16, 2022, 3 days before disclosure) and 5.6.4 (released May 16, 2022, 3 days before disclosure).

    The latest release, 7.1.2, is not affected.

  • Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail…

    Affected: from 5.4.0, fixed in 5.4.4; from 5.3.0, fixed in 5.3.8; fixed in 5.2.9.

    Fixed in 5.2.9.RELEASE (released Feb 11, 2021, 12 days before disclosure), 5.3.8.RELEASE (released Feb 11, 2021, 12 days before disclosure) and 5.4.4 (released Feb 12, 2021, 11 days before disclosure).

    The latest release, 7.1.2, is not affected.