CVE-2016-5007

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x,
4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for
mapping requests to controllers respectively. Differences in the strictness
of the pattern matching mechanisms, for example with regards to space
trimming in path segments, can lead Spring Security to not recognize
certain paths as not protected that are in fact mapped to Spring MVC
controllers that should be protected. The problem is compounded by the fact
that the Spring Framework provides richer features with regards to pattern
matching as well as by the fact that pattern matching in each Spring
Security and the Spring Framework can easily be customized creating
additional differences.