Product by Spring
Spring Security
29 known vulnerabilities in Spring Security (Spring), 0 of them actively exploited (CISA KEV).
Key figures
29
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-41232 | Spring Security: security vulnerability | 9.1 | |
| Critical | CVE-2026-59270 | Spring Security: security vulnerability | 9.4 | |
| High | CVE-2019-11272 | PlaintextPasswordEncoder authenticates encoded passwords that are null | 7.3 | |
| High | CVE-2026-41707 | Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay | 7.4 | |
| Medium | CVE-2019-3795 | Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security | 3.8 | |
| High | CVE-2026-47877 | Spring Security: Cross-Site Scripting (XSS) | 8.2 | |
| High | CVE-2026-47841 | WebAuthn User Verification Bypass via Session Serialization | 7.4 | |
| High | CVE-2025-22228 | Spring Security: security vulnerability | 7.4 | |
| High | CVE-2026-22733 | Authentication Bypass under Actuator CloudFoundry endpoints | 8.2 | |
| High | CVE-2024-22234 | Spring Security: Improper Access Control | 7.4 | |
| High | CVE-2026-40988 | Unbounded DEFLATE Inflation in SAML 2.0 Service Provider | 7.5 | |
| Medium | CVE-2026-59276 | Timing Attack via Non-Constant-Time Comparison of Sensitive Values | 5.9 | |
| High | CVE-2026-22747 | Unauthorized User Impersonation when Using X.509 Client Certificates | 8.1 | |
| High | CVE-2026-41003 | Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting | 7.6 | |
| Medium | CVE-2026-47842 | Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation | 6.5 | |
| High | CVE-2026-22754 | ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules | 7.5 | |
| High | CVE-2026-22753 | Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers | 7.5 | |
| High | CVE-2026-40993 | Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry | 7.3 | |
| High | CVE-2026-47838 | Unauthorized User Impersonation when Using X.509 Client Certificates | 6.8 | |
| High | CVE-2024-38810 | Missing Authorization When Using @AuthorizeReturnObject | 6.5 | |
| Medium | CVE-2026-41706 | Open Redirect When Using CookieRequestCache | 6.1 | |
| Medium | CVE-2026-22748 | Potential Security Misconfiguration when Using withIssuerLocation | 6.5 | |
| Medium | CVE-2025-22223 | Spring Security: Authentication Bypass by Spoofing | 5.3 | |
| Medium | CVE-2026-41008 | Spring Security Authorization Server Open Redirect via request_uri | 6.1 | |
| Medium | CVE-2025-22234 | Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation | 5.3 |