CVE-2026-22732: Spring Security HTTP Headers Are not Written Under Some Conditions
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
Published Mar 20, 2026
Affected packages
org.springframework.security:spring-security-web
- Ecosystem
- Maven
- Affected
- <= 5.7.14
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.springframework.security:spring-security-web
org.springframework.security:spring-security-web
- Ecosystem
- Maven
- Affected
- >= 5.8.0, <= 5.8.16
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.springframework.security:spring-security-web
org.springframework.security:spring-security-web
- Ecosystem
- Maven
- Affected
- >= 6.0.0, <= 6.3.10
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.springframework.security:spring-security-web
org.springframework.security:spring-security-web
- Ecosystem
- Maven
- Affected
- >= 6.4.0, <= 6.4.13
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.springframework.security:spring-security-web
org.springframework.security:spring-security-web
- Ecosystem
- Maven
- Affected
- >= 6.5.0, < 6.5.9
- Fixed in
- 6.5.9
- Check
mvn dependency:tree -Dincludes=org.springframework.security:spring-security-web
org.springframework.security:spring-security-web
- Ecosystem
- Maven
- Affected
- >= 7.0.0, < 7.0.4
- Fixed in
- 7.0.4
- Check
mvn dependency:tree -Dincludes=org.springframework.security:spring-security-web
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology