CVE-2026-22732

Spring Security applications use by default so-called lazy writing of HTTP response headers. Under certain conditions, this mechanism does not guarantee actual inclusion of configured security headers in the sent HTTP response. This results in a situation where the browser or HTTP client does not receive protective headers, even though they have been configured on the application side. The vulnerability is classified as CWE-425 (Direct Request / Forced Browsing), indicating the possibility of bypassing access control mechanisms or protection.

An attacker may potentially bypass security measures implemented through HTTP headers (e.g., content security policies, anti-clickjacking mechanisms), which may lead to disclosure of sensitive information or violation of application resource integrity.

Apply patches available from the vendor according to references published at https://spring.io/security/cve-2026-22732. It is recommended to update Spring Security to versions higher than the indicated ranges of vulnerable releases.

VMware Spring Security — servlet applications using default (lazy) HTTP response header writing: versions 5.7.0 to 5.7.21, 5.8.0 to 5.8.23, 6.3.0 to 6.3.14, 6.4.0 to 6.4.14, 6.5.0 to 6.5.8, and 7.0.0 to 7.0.3.