High severity · published Apr 22, 2026
CVE-2026-22753
Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests.This issue affects Spring Security: from 7.0.0 through 7.0.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Spring Security · Spring
7.0.0 through 7.0.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22753
Mitigation
https://spring.io/security/cve-2026-22753
More from Spring Security
9.1
CVE-2026-59270
Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
8.1
CVE-2026-47838
Unauthorized User Impersonation when Using X.509 Client Certificates
8.1
CVE-2026-22747
Unauthorized User Impersonation when Using X.509 Client Certificates
8.1
CVE-2026-22733
Authentication Bypass under Actuator CloudFoundry endpoints
7.5
CVE-2026-40988
Unbounded DEFLATE Inflation in SAML 2.0 Service Provider