by Kastro
Paper/Archive/CVE-2026-22732

CVE-2026-22732

VMware Spring Security — Under Some Conditions Spring Security HTTP Headers Are not Written

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.1.421 × 208.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.  This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

Affected

ProductAffectedFixed inSource
Spring Security5.7.0 – 5.7.21–CNA
Spring Security5.8.0 – 5.8.23–CNA
Spring Security6.3.0 – 6.3.14–CNA
Spring Security6.4.0 – 6.4.14–CNA
Spring Security6.5.0 – 6.5.8–CNA
Spring Security7.0.0 – 7.0.3–CNA

Scores by source

vmware (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refspring.io/security/cve-2026-22732