# org.springframework.security:spring-security-web (Maven) vulnerabilities 7 known vulnerabilities (2 critical, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.1.2 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 7.1.2 (Oct 22, 2026), the latest release - Dependents: 644 - Releases: 280 since 3.0.0.RELEASE (Dec 23, 2009) - Registry: https://central.sonatype.com/artifact/org.springframework.security/spring-security-web - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-47838: 3.0.0.RELEASE to 6.5.10 (6.5.11 is outside it) - CVE-2026-41706: 3.0.0.RELEASE to 5.8.16 (6.0.0 is outside it); 6.3.0 to 6.3.10 (6.4.0 is outside it); 6.5.0 to 6.5.10 (6.5.11 is outside it); 7.0.0 to 7.0.5 (7.0.6 is outside it) - CVE-2026-22747: 7.0.0 to 7.0.4 (7.0.5 is outside it) - CVE-2026-22732: 3.0.0.RELEASE to 6.5.8 (6.5.9 is outside it); 7.0.0 to 7.0.3 (7.0.4 is outside it) - CVE-2024-38821: 5.0.0.RELEASE to 5.7.12 (5.7.13 is outside it); 5.8.0 to 5.8.14 (5.8.15 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it); 6.3.0 to 6.3.3 (6.3.4 is outside it) - CVE-2022-22978: 3.0.0.RELEASE to 5.4.10 (5.4.11 is outside it); 5.5.0 to 5.5.6 (5.5.7 is outside it); 5.6.0 to 5.6.3 (5.6.4 is outside it) - CVE-2021-22112: 3.0.0.RELEASE to 5.2.8.RELEASE (5.2.9.RELEASE is outside it); 5.3.0.RELEASE to 5.3.7.RELEASE (5.3.8.RELEASE is outside it); 5.4.0 to 5.4.3 (5.4.4 is outside it) ## Advisories (7) ### [CVE-2026-47838](https://cve.now/CVE-2026-47838): Unauthorized User Impersonation when Using X.509 Client Certificates - Severity: Medium 6.8 - Published: Jun 9, 2026 - Affected: from 6.5.0, fixed in 6.5.11; from 6.4.0, through 6.4.13; from 6.0.0, through 6.3.10; from 5.8.0, through 5.8.16; through 5.7.14. - Fixed in 6.5.11 (released Jun 9, 2026, the day of disclosure). - The latest release, 7.1.2, is not affected. ### [CVE-2026-41706](https://cve.now/CVE-2026-41706): Open Redirect When Using CookieRequestCache - Severity: Medium 6.1 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.6; from 6.5.0, fixed in 6.5.11; from 6.3.0, through 6.3.16; from 5.8.0, through 5.8.25; through 5.7.23. - Fixed in 6.5.11 (released Jun 9, 2026, the day of disclosure) and 7.0.6 (released Jun 9, 2026, the day of disclosure). - The latest release, 7.1.2, is not affected. ### [CVE-2026-22747](https://cve.now/CVE-2026-22747): Unauthorized User Impersonation when Using X.509 Client Certificates - Severity: Medium 6.8 - Published: Apr 22, 2026 - Affected: from 7.0.0, fixed in 7.0.5. - Fixed in 7.0.5 (released Apr 20, 2026, 2 days before disclosure). - The latest release, 7.1.2, is not affected. ### [CVE-2026-22732](https://cve.now/CVE-2026-22732): Under Some Conditions Spring Security HTTP Headers Are not Written - Severity: Critical 9.1 - Published: Mar 19, 2026 - Affected: through 5.7.14; from 5.8.0, through 5.8.16; from 6.0.0, through 6.3.10; from 6.4.0, through 6.4.13; from 6.5.0, fixed in 6.5.9; from 7.0.0, fixed in 7.0.4. - Fixed in 6.5.9 (released Mar 16, 2026, 3 days before disclosure) and 7.0.4 (released Mar 16, 2026, 3 days before disclosure). - The latest release, 7.1.2, is not affected. ### [CVE-2024-38821](https://cve.now/CVE-2024-38821): Authorization Bypass of Static Resources in WebFlux Applications - Severity: Critical 9.1 - Published: Oct 28, 2024 - Affected: from 5.0.0, fixed in 5.7.13; from 5.8.0, fixed in 5.8.15; from 6.2.0, fixed in 6.2.7; from 6.0.0, fixed in 6.0.13; from 6.1.0, fixed in 6.1.11; from 6.3.0, fixed in 6.3.4. - Fixed in 5.7.13 (released Oct 21, 2024, 7 days before disclosure), 5.8.15 (released Oct 21, 2024, 7 days before disclosure), 6.2.7 (released Oct 21, 2024, 7 days before disclosure, the advisory names 6.0.13, which was never published) and 1 other version. - The latest release, 7.1.2, is not affected. ### [CVE-2022-22978](https://cve.now/CVE-2022-22978): In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be… - Severity: Unrated - Published: May 19, 2022 - Affected: from 5.5.0, fixed in 5.5.7; from 5.6.0, fixed in 5.6.4; fixed in 5.4.11. - Fixed in 5.4.11 (released Mar 20, 2023, 305 days after disclosure), 5.5.7 (released May 16, 2022, 3 days before disclosure) and 5.6.4 (released May 16, 2022, 3 days before disclosure). - The latest release, 7.1.2, is not affected. ### [CVE-2021-22112](https://cve.now/CVE-2021-22112): Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail… - Severity: Unrated - Published: Feb 23, 2021 - Affected: from 5.4.0, fixed in 5.4.4; from 5.3.0, fixed in 5.3.8; fixed in 5.2.9. - Fixed in 5.2.9.RELEASE (released Feb 11, 2021, 12 days before disclosure), 5.3.8.RELEASE (released Feb 11, 2021, 12 days before disclosure) and 5.4.4 (released Feb 12, 2021, 11 days before disclosure). - The latest release, 7.1.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.springframework.security:spring-security-web Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.