IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
9.1Kritik

CVE-2026-22732Under Some Conditions Spring Security HTTP Headers Are not Written

VMware Spring Security Yayım: (8 ay önce)

Açıklama

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.  This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

Zayıflık türü (CWE): CWE-425

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
VMware Spring Security 5.7.0 – ≤ 5.7.21, 5.8.0 – ≤ 5.8.23, 6.3.0 – ≤ 6.3.14, 6.4.0 – ≤ 6.4.14, 6.5.0 – ≤ 6.5.8, 7.0.0 – ≤ 7.0.3

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (6)
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* < 5.7.22
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 5.8.0 < 5.8.24
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 6.3.0 < 6.3.15
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 6.4.0 < 6.4.15
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 6.5.0 < 6.5.9
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.4

Aynı üründe son açıklar — Spring Framework / Boot

3.7Düşük
CVE-2026-59314

Spring Framework response splitting in ContentDisposition

Spring Spring Framework

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.2…

6.1Orta
CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Spring Spring Framework

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScrip…