Business Logic Vulnerability org.springframework.security:spring-security-web Dependency in Crowd Data Center

This is a vulnerability in a non-Atlassian dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Business Logic vulnerability was introduced in versions 5.3.0, 6.0.0, 6.1.0, 6.2.0, 6.3.0, 7.0.1, 7.1.0 of Crowd Data Center. This...

Certificate Impersonation

spring-security-web is vulnerable to certificate impersonation. The vulnerability is due to improper parsing of malformed X.509 certificate CN values in SubjectX500PrincipalExtractor, which can result in extracting an incorrect username and allow attackers to impersonate another user...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +914 more potentially affected by CVE-2026-22747 via org.springframework.security:spring-security-web (>=7.0.0-m1, <=7.0.4)

org.springframework.security:spring-security-web MAVEN version =7.0.0-m1, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +914 more potentially affected by CVE-2026-22747 via org.springframework.security:spring-security-web (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-web MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +914 more potentially affected by CVE-2026-22747 via org.springframework.security:spring-security-web (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-web MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +914 more potentially affected by CVE-2026-22747 via org.springframework.security:spring-security-web (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-web MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

africa.absa:inception-oauth2-resource-server (>=1.0.0, <=1.2.0), ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0) +10437 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (>=3.2.8.release, <=6.5.8)

org.springframework.security:spring-security-web MAVEN version =3.2.8.release, =1.0.0, =4.4.0.0, =0.1.8, =0.1.6, =0.1.2, =0.5.0, =cloud-0.1, =j8.2.4.0, =j8.2.4.0, =j11.2.6.1 - ai.ylyue:yue-library-base j17.3.3.1 - ai.ylyue:yue-library-base-crypto j17.3.3.1 - ai.ylyue:yue-library-data-log j17.3.3....

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +804 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (>=7.0.0-m1, <=7.0.3)

org.springframework.security:spring-security-web MAVEN version =7.0.0-m1, =0.2.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =1.28.1, =7.0.0-beta.1, =7.1.0 and more Source cves: CVE-2026-22732 Sour...

Use of Cache Containing Sensitive Information

Overview org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the process of writing HTTP response heade...

am.ik.home:uaa-client (>=1.3.0, <=1.8.1), am.ik.home:uaa-integration-test (>=1.3.0, <=1.8.1) +86 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.1.release)

org.springframework.security:spring-security-web MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - am.ik.home:uaa-client =1.3.0, =1.3.0, =1.3.0, =0.2.0,...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +90 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.5.release)

org.springframework.security:spring-security-web MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

com.foreach.imageserver:imageserver-admin (5.0.0.release), com.foreach.imageserver:imageserver-test-embedded (5.0.0.release) +66 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.10.release)

org.springframework.security:spring-security-web MAVEN version 4.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.foreach.imageserver:imageserver-admin 5.0.0.releas...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=1.12.0), com.atlassian.asap:asap-server-spring-security (>=2.21.8, <=2.21.9) +107 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.11.release)

org.springframework.security:spring-security-web MAVEN version 4.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - au.org.consumerdatastandards:client-cli =1.1.1, =2.21....

org.springframework.security:spring-security-cas (4.2.14.release), org.springframework.security:spring-security-openid (4.2.14.release) +2 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.14.release)

org.springframework.security:spring-security-web MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

com.capitalone.dashboard:api (>=3.3.0, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.5.1, <=3.7.33) +71 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.18.release)

org.springframework.security:spring-security-web MAVEN version 4.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.capitalone.dashboard:api =3.3.0, =3.5.1, =3.2.0,...

com.github.waffle.demo:waffle-spring-filter (3.0.0), com.github.waffle.demo:waffle-spring-form (3.0.0) +23 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.19.release)

org.springframework.security:spring-security-web MAVEN version 4.2.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.waffle.demo:waffle-spring-filter 3.0.0 -...

com.github.lrkwz:urlmanaged-locale (0.0.1), com.revolsys.open:com.revolsys.open.orm (>=2012.07.30.release, <=2012.11.01.release) +30 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.0.7.release)

org.springframework.security:spring-security-web MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.lrkwz:urlmanaged-locale 0.0.1 -...

com.carecon.fabric3:fabric3-spring (>=3.0.0, <=3.1.0), com.carecon.fabric3:fabric3-spring-library (>=3.0.0, <=3.1.0) +17 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.0.8.release)

org.springframework.security:spring-security-web MAVEN version 3.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.carecon.fabric3:fabric3-spring =3.0.0, =3.0.0,...

com.github.leleuj.springframework.security:spring-security-oauth-client (>=1.0.0, <=1.1.0), com.github.lltyk:tapestry-spring-security (>=3.0.4, <=3.0.5) +72 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.1.0.release)

org.springframework.security:spring-security-web MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: -...

com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6), com.paddypowerbetfair.springframework:spring-security-saml-keys-rollover (1.0.2) +23 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.1.2.release)

org.springframework.security:spring-security-web MAVEN version 3.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.dblock.waffle:waffle-spring-security3 =1.5,...