CVE-2023-34034

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@vmware.com

Published

2023-07-19

Last modified

2026-05-01

Weaknesses

CWE-281

Affected products

• Spring Security (Vmware)

References

• https://security.netapp.com/advisory/ntap-20230814-0008/
• https://spring.io/security/cve-2023-34034