SS
Product
Spring Security
44
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 19Medium 17Low 1
Watch
Add Spring Security to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59354 | 8.8 | Aug 27 | Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata Affected: 7.0.0 before 7.0.5 |
| CVE-2021-22112 | 8.8 | Feb 23 | Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is… Affected: 5.4.0 before 5.4.4 |
| CVE-2026-47838 | 8.1 | Jun 9 | Unauthorized User Impersonation when Using X.509 Client Certificates Affected: before 5.7.25; 5.8.0 before 5.8.27; 6.3.0 before 6.3.18; 6.4.0 before 6.4.18; 6.5.0 before 6.5.11 |
| CVE-2026-22747 | 8.1 | Apr 22 | Unauthorized User Impersonation when Using X.509 Client Certificates Affected: 7.0.0 before 7.0.5 |
| CVE-2022-31690 | 8.1 | Oct 31 | Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions Affected: 5.6.0 before 5.6.9; 5.7.0 before 5.7.5 |
| CVE-2017-4995 | 8.1 | Nov 27 | An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1 Affected: 4.2.0; 4.2.1; 4.2.2; 5.0.0 |
| CVE-2026-40988 | 7.5 | Jun 9 | Unbounded DEFLATE Inflation in SAML 2.0 Service Provider Affected: 5.7.0 before 5.7.24; 5.8.0 before 5.8.26; 6.3.0 before 6.3.17; 6.4.0 before 6.4.17; 6.5.0 before 6.5.10.2; 7.0.0 before 7.0.5.1 |
| CVE-2026-22754 | 7.5 | Apr 22 | ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules Affected: 7.0.0 before 7.0.5 |
| CVE-2026-22753 | 7.5 | Apr 22 | Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers Affected: 7.0.0 before 7.0.5 |
| CVE-2024-38810 | 7.5 | Aug 20 | Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective Affected: 6.3.0 before 6.3.2 |
| CVE-2021-22119 | 7.5 | Jun 29 | Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the… Affected: 5.2.0 before 5.2.11; 5.3.0 before 5.3.10; 5.4.0 before 5.4.7; 5.5.0 before 5.5.1 |
| CVE-2016-5007 | 7.5 | May 25 | Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; +11 more |
| CVE-2016-9879 | 7.5 | Jan 6 | An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1 Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; +9 more |
| CVE-2026-47841 | 7.4 | Aug 26 | WebAuthn User Verification Bypass via Session Serialization Affected: 6.4.0 before 6.4.19; 6.5.0 before 6.5.12; 7.0.0 before 7.0.6.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-41707 | 7.4 | Aug 25 | Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay Affected: 6.5.0 before 6.5.12; 7.0.0 before 7.0.6.1; 7.1.0 before 7.1.0.1 |
| CVE-2024-22234 | 7.4 | Feb 20 | In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the… Affected: 6.1.0 before 6.1.7; 6.2.0 before 6.2.2 |
| CVE-2019-11272 | 7.3 | Jun 26 | Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder Affected: before 4.2.13 |
| CVE-2014-0097 | 7.3 | May 25 | The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length Affected: 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; +2 more |
| CVE-2026-40993 | 7.2 | Jun 9 | Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry Affected: 7.0.0 before 7.0.5.1 |
Showing 19