← Back

CVE-2026-22732

nvd nist
Published: Mar 19, 2026Modified: Jun 17, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability: 3.9 / Impact: 5.2
Source: security@vmware.com (Secondary)

Description

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.  This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

Affected (6)

Vmware
1 product
Spring Security
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Security
Before 5.7.22
Spring Security
From 5.8.0 to 5.8.24
Spring Security
From 6.3.0 to 6.3.15
Spring Security
From 6.4.0 to 6.4.15
Spring Security
From 6.5.0 to 6.5.9
Spring Security
From 7.0.0 to 7.0.4

Related CWEs

CWE-425
Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (1)

Source: security@vmware.com
ExploitVendor Advisory

Timeline

No history available yet.