CVE-2026-22732 - Vulnerability Analysis

Overview

Spring Security 5.7.0 to 5.7.21, 5.8.0 to 5.8.23, 6.3.0 to 6.3.14, 6.4.0 to 6.4.14, and 6.5.0 to 7.0.3 contains an insecure configuration caused by failure to write HTTP response headers in servlet applications, letting attackers potentially bypass security controls, exploit requires specific application configuration.

Severity & Score

Impact

Attackers can bypass security controls due to missing HTTP headers, potentially leading to information disclosure or other attacks.

Mitigation

Update to a version later than 7.0.3 or the latest available version.

References

• https://spring.io/security/cve-2026-22732

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner