Spring Spring Security vulnerabilities

CVEs per yearBy the year they were published

1. 20192
2. 20242
3. 20253
4. 202622

Newest CVEs

• CVE-2026-59277

  Spring Security InetAddressMatchers Incomplete Internal Network Classification

  Spring · Spring Security

  Low3.7
• CVE-2026-59276

  Timing Attack via Non-Constant-Time Comparison of Sensitive Values

  Spring · Spring Security

  Medium5.9
• CVE-2026-59270

  Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

  Spring · Spring Security

  Critical9.4
• CVE-2026-47877

  Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

  Spring · Spring Security

  High8.2
• CVE-2026-47842

  Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

  Spring · Spring Security

  Medium6.5
• CVE-2026-47841

  WebAuthn User Verification Bypass via Session Serialization

  Spring · Spring Security

  High7.4
• CVE-2026-41707

  Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

  Spring · Spring Security

  High7.4
• CVE-2026-47838

  Unauthorized User Impersonation when Using X.509 Client Certificates

  Spring · Spring Security

  Medium6.8
• CVE-2026-41706

  Open Redirect When Using CookieRequestCache

  Spring · Spring Security

  Medium6.1
• CVE-2026-41694

  SAML Payloads Decrypted Without Valid Signature

  Spring · Spring Security

  Low3.7