IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.5High

CVE-2026-22753Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers

Spring Spring Security Published: (6 months ago)

Description

Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests.This issue affects Spring Security: from 7.0.0 through 7.0.4.

Weakness (CWE): CWE-693

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
Spring Spring Security 7.0.0 – ≤ 7.0.4
vmware spring security 7.0.0 – < 7.0.5

References and patches

CPE matches (NVD) (1)
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.5

Recent CVEs in the same product — Spring Framework / Boot

3.7Low
CVE-2026-59314

Spring Framework response splitting in ContentDisposition

Spring Spring Framework

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.2…

6.1Medium
CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Spring Spring Framework

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScrip…