PT-2026-34253 · Spring · Spring Security

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-22753

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Spring Security versions 7.0.0 through 7.0.4

Description An issue exists when an application utilizes the securityMatchers(String) method and a PathPatternRequestMatcher.Builder bean to prepend a servlet path. This configuration can cause request matching to the filter chain to fail, preventing related security components from executing. Consequently, authentication, authorization, and other security controls may become inactive for the intended requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2026-22753

GHSA-4WRG-8WPC-H923

Affected Products

Spring Security

References · 6

• https://spring.io/security/cve-2026-22753 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4wrg-8wpc-h923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22753 · Security Note
• https://github.com/spring-projects/spring-security · Note
• https://twitter.com/infoflowcloud/status/2047429996315033610 · Twitter Post
• https://twitter.com/CVEnew/status/2047428158128017869 · Twitter Post