ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

Spring Security CVE-2026-22732 Detection / Remediation Tool

This OpenRewrite tool detects Java projects susceptible to CVE-2026-22732 in Spring Security and provides automated remediation recipes. It identifies affected Spring Security versions and response handling patterns that can cause security headers to be omitted, and can remediate affected project...

CLEANSTART-2026-GB34662 Security fixes in thingsboard 4.2.1.1-r4

Package thingsboard version 4.2.1.1-r4 fixes 1 vulnerabilities: CVE-2026-22732...

Security Bulletin: Security Vulnerability in Spring-Security affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22732)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring-Security Vulnerability Details CVEID:CVE-2026-22732 DESCRIPTION: When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility th...

Security Bulletin: MongoDB Enterprised Advanced affected by: Direct Request ('Forced Browsing') (CVE-2026-22732)

Summary There are vulnerabilities in spring-security-web-6.5.7.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-22732. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-22732 DESCRIPTION: When applications specify HTTP response headers for servlet...

Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-security-web (CVE-2026-22732)

Summary IBM Sterling Control Center is affected by a vulnerability CVE-2026-22732 reported for spring-security-web-6.4.12.jar. Vulnerability Details CVEID:CVE-2026-22732 DESCRIPTION: When applications specify HTTP response headers for servlet applications using Spring Security, there is the...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to issues in Spring

Summary There are vulnerabilities in Spring used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs CVE-2026-22732, CVE-2026-22735, CVE-2026-22737. Vulnerability Details CVEID:CVE-2026-22737 DESCRIPTION: Use of...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary Maximo AI Service uses nltk-3.9.1-py3-none-any.whl, mlflow-3.1.0-py3-none-any.whl, and spring-security-web-6.5.7.jar, which are vulnerable to CVE-2025-14009, CVE-2026-2635, CVE-2026-0848, and CVE-2026-22732. This bulletin contains information regarding how to address the vulnerabilities...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of Spring Security

Summary Due to use of Spring Security, DevOps Test Performance and Rational Performance Tester contain a vulnerability that can potentially result in clickjacking, XSS, and sensitive data exposure via caching. CVE-2026-22732 Vulnerability Details CVEID:CVE-2026-22732 DESCRIPTION: When application...

Use of Cache Containing Sensitive Information

Overview org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the process of writing HTTP response heade...

com.racquettrack:spring-security-oauth2-client (1.4), com.wichell:framework-web-security (1.0.0) +24 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.1.1.release)

org.springframework.security:spring-security-web MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.racquettrack:spring-security-oauth2-client 1.4 -...

cc.chensoul.nacos:nacos-distribution (2.5.2), com.buession.security:buession-security-spring (>=3.0.0, <=3.0.1) +588 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-web MAVEN version =5.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.11.0, =5.11.0, =1.48.0, =1.48.0, =1.48.0, =2.4.0, =2.4.0, =2.4.0, =4.5.0, =4.5.0, =4.5.1 and more Source cves: CVE-2026-22732 Source advisory: GHSA-MF92-479X-3373...

am.ik.home:uaa-client (1.9.0), am.ik.home:uaa-integration-test (1.9.0) +410 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.2.release)

org.springframework.security:spring-security-web MAVEN version 4.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - am.ik.home:uaa-client 1.9.0 -...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +799 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (>=7.0.0, <=7.0.3)

org.springframework.security:spring-security-web MAVEN version =7.0.0, =0.2.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =1.28.1, =7.0.0-beta.1, =7.1.0 and more Source cves: CVE-2026-22732 Source...

co.paralleluniverse:comsat-spring-boot-security (0.5.0), co.paralleluniverse:comsat-spring-security (0.5.0) +69 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.0.2.release)

org.springframework.security:spring-security-web MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - co.paralleluniverse:comsat-spring-boot-security 0.5.0 -...

org.springframework.security:spring-security-cas (3.1.5.release), org.springframework.security:spring-security-openid (3.1.5.release) +1 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.1.5.release)

org.springframework.security:spring-security-web MAVEN version 3.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +3622 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (>=6.0.0, <=6.3.10)

org.springframework.security:spring-security-web MAVEN version =6.0.0, =cloud-0.1, =0.5.2, =0.5.0, =7.0.0, =7.2.0 and more Source cves: CVE-2026-22732 Source advisory: GHSA-MF92-479X-3373...

at.molindo.social:spring-social-security (1.1.0.release), cn.jhc:spring-social-qq (>=0.0.2, <=0.0.5) +105 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.2.3.release)

org.springframework.security:spring-security-web MAVEN version 3.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - at.molindo.social:spring-social-security 1.1.0.release ...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +71 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.1.4.release)

org.springframework.security:spring-security-web MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =3.0.1.3,...

com.carecon.fabric3:fabric3-spring (>=3.0.0, <=3.1.0), com.carecon.fabric3:fabric3-spring-library (>=3.0.0, <=3.1.0) +17 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.0.8.release)

org.springframework.security:spring-security-web MAVEN version 3.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.carecon.fabric3:fabric3-spring =3.0.0, =3.0.0,...