2878 matches found
Spring Security 6.5.x < 6.5.12 / 7.0.x < 7.0.6.1 / 7.1.x < 7.1.0.1 DPoP Proof Replay
The version of Spring Security installed on the remote host is 6.5.x prior to 6.5.12, 7.0.x prior to 7.0.6.1, or 7.1.x prior to 7.1.0.1. It is, therefore, affected by a vulnerability: - Spring Security's DPoPProofJwtDecoderFactory uses an internal cache to store the processed jti JWT ID claims,...
Security Bulletin: Vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas. Vulnerabilities include resource exhaustion and...
Security Bulletin: Vulnerabilities in Netty,Spring Boot,ZDRES-232,Apache HttpComponents,Spring Security,PostCSS,spring-cloud-gateway-server might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Spring Boot, ZDRES-232, Apache HttpComponents,Spring Security, PostCSS,spring-cloud-gateway-server. Vulnerabilities include attacker supplies com.myapp.SomeClass causes clinit of SomeClass â€" and many...
CVE-2026-41707
A flaw was found in Spring Security's DPoPProofJwtDecoderFactory. This vulnerability allows a remote attacker to perform a replay attack by flooding the server with dummy requests, which evicts legitimate entries from an internal cache storing JSON Web Token JWT ID claims. Consequently, an attack...
ROOT-APP-MAVEN-CVE-2024-22257 CVE-2024-22257 in org.springframework.security:spring-security-core - Patched by Root
Root has patched CVE-2024-22257 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2025-22228 CVE-2025-22228 in org.springframework.security:spring-security-crypto - Patched by Root
Root has patched CVE-2025-22228 in the org.springframework.security:spring-security-crypto package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2022-31692 CVE-2022-31692 in org.springframework.security:spring-security-core - Patched by Root
Root has patched CVE-2022-31692 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2025-41248 CVE-2025-41248 in org.springframework.security:spring-security-core - Patched by Root
Root has patched CVE-2025-41248 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2025-41232 CVE-2025-41232 in org.springframework.security:spring-security-core - Patched by Root
Root has patched CVE-2025-41232 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...
Session Fixation
Overview org.opencastproject:base is a free and open source solution for automated video capture and distribution at scale. Affected versions of this package are vulnerable to Session Fixation via URL-based jsessionid handling in the Spring Security HTTP configuration in...
CVE-2026-84860
ScadaLTS 2.8.1-release-candidate build 0 suffers from an Authorization Bypass in its DWR (Direct Web Remoting) component. Spring Security restricts DWR endpoints by URL path pattern , but DWR actually dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName . Addi...
ROOT-APP-MAVEN-CVE-2026-41003 CVE-2026-41003 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root
Root has patched CVE-2026-41003 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-40993 CVE-2026-40993 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root
Root has patched CVE-2026-40993 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-40988 CVE-2026-40988 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root
Root has patched CVE-2026-40988 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...
Security Bulletin: Multiple Security Vulnerabilities in Spring Security affect IBM Sterling B2B Integrator and IBM Sterling File Gateway
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-40988 DESCRIPTION: An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable...
This Week in Spring - September 15th, 2026
Hi, Spring fans! Welcome to another rip-roarin' installment of This Week in Spring! I'm writing this to you from sun-kissed San Francisco, CA, sipping some coffee and watching the bay from my breakfast nook. What a wonderful day! A wonderful day in which to learn about the latest and greatest in...
CLSA-2026-1789410116 TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.8.16-tuxcare.15...
CLSA-2026-1789407633 TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.7.12-tuxcare.9...
Security Bulletin: Security Misconfiguration Vulnerability in Spring Security Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22748)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-22748 DESCRIPTION: Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecode...
