PT-2026-26435 · Spring · Spring Security

Wyfrel · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-22732

NVD

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.  This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

Fix

Related Identifiers

CVE-2026-22732

Affected Products

Spring Security

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-22732 · Security Note
• https://twitter.com/0dayPublishing/status/2034769171871941025 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034778623513960927 · Twitter Post
• https://twitter.com/JFrogSecurity/status/2034697012864594206 · Twitter Post
• https://spring.io/security/cve-2026-22732 · Note
• https://twitter.com/CveFindCom/status/2034777597909803071 · Twitter Post