Spring Security (Vmware) - vulnerabilities (CVEs)

44 CVEs, 0 in the last 30 days, 411 known versions, newest CVE from 2026-08-27. Vendor: Vmware.

CVEs of Spring Security

• CVE-2026-59277 - CVSS 5.3 (medium), 2026-08-27: Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a…
• CVE-2026-59276 - CVSS 5.9 (medium), 2026-08-27: Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time…
• CVE-2026-59354 - CVSS 9.6 (critical), 2026-08-27: In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the…
• CVE-2026-59270 - CVSS 9.4 (critical), 2026-08-27: Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all…
• CVE-2026-47877 - CVSS 8.2 (high), 2026-08-27: Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security…
• CVE-2026-47842 - CVSS 6.5 (medium), 2026-08-26: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with…
• CVE-2026-47841 - CVSS 7.4 (high), 2026-08-26: An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring…
• CVE-2026-41707 - CVSS 7.4 (high), 2026-08-25: Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based…
• CVE-2026-47838 - CVSS 8.1 (high), 2026-06-10: SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the…
• CVE-2026-41706 - CVSS 6.1 (medium), 2026-06-10: Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected…
• CVE-2026-41003 - CVSS 7.6 (high), 2026-06-10: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.…
• CVE-2026-40993 - CVSS 7.3 (high), 2026-06-10: An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store…
• CVE-2026-41694 - CVSS 5.3 (medium), 2026-06-10: Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature,…
• CVE-2026-41008 - CVSS 6.1 (medium), 2026-06-10: Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious…
• CVE-2026-40988 - CVSS 7.5 (high), 2026-06-10: An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by…
• CVE-2026-22754 - CVSS 7.5 (high), 2026-04-22: Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet…
• CVE-2026-22753 - CVSS 7.5 (high), 2026-04-22: Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet…
• CVE-2026-22748 - CVSS 6.5 (medium), 2026-04-22: Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure…
• CVE-2026-22747 - CVSS 8.1 (high), 2026-04-22: Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead…
• CVE-2026-22746 - CVSS 3.7 (low), 2026-04-22: Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes,…
• CVE-2026-22751 - CVSS 4.8 (medium), 2026-04-21: Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a…
• CVE-2026-22732 - CVSS 9.1 (critical), 2026-03-19: When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be…
• CVE-2025-41248 - CVSS 7.5 (high), 2025-09-16: The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type…
• CVE-2024-38810 - CVSS 7.5 (high), 2024-08-20: Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.
• CVE-2024-22234 - CVSS 7.4 (high), 2024-02-20: In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly…
• CVE-2023-34042 - CVSS 5.5 (medium), 2024-02-05: The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with…
• CVE-2023-34034 - CVSS 9.8 (critical), 2023-07-19: Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and…
• CVE-2023-34035 - CVSS 7.3 (high), 2023-07-18: Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the…
• CVE-2023-20862 - CVSS 6.3 (medium), 2023-04-19: In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly…
• CVE-2022-31690 - CVSS 8.1 (high), 2022-10-31: Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under…
• CVE-2022-31692 - CVSS 9.8 (critical), 2022-10-31: Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher…
• CVE-2022-22978 - CVSS 9.8 (critical), 2022-05-19: In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed…
• CVE-2022-22976 - CVSS 5.3 (medium), 2022-05-19: Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using…
• CVE-2021-22119 - CVSS 7.5 (high), 2021-06-29: Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service…
• CVE-2021-22112 - CVSS 8.8 (high), 2021-02-23: Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the…
• CVE-2020-5408 - CVSS 6.5 (medium), 2020-05-14: Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null…
• CVE-2019-11272 - CVSS 7.3 (high), 2019-06-26: Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application…
• CVE-2019-3795 - CVSS 5.3 (medium), 2019-04-09: Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using…
• CVE-2018-1199 - CVSS 5.3 (medium), 2018-03-16: Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before…
• CVE-2017-4995 - CVSS 8.1 (high), 2017-11-27: An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default…
• CVE-2016-5007 - CVSS 7.5 (high), 2017-05-25: Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping…
• CVE-2014-3527 - CVSS 9.8 (critical), 2017-05-25: When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a…
• CVE-2014-0097 - CVSS 7.3 (high), 2017-05-25: The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows…
• CVE-2016-9879 - CVSS 7.5 (high), 2017-01-06: An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path…
• CVE-2011-2894 - CVSS 6.8 (medium), 2011-10-04: Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from…