CVE-2026-22732 PUBLISHED

Under Some Conditions Spring Security HTTP Headers Are not Written

Assigner: vmware
Reserved: 09.01.2026 Published: 19.03.2026 Updated: 20.03.2026

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.  This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1

Product Status

Vendor Spring
Product Spring Security
Versions Default: unaffected
  • affected from 5.7.0 to 5.7.21 (incl.)
  • affected from 5.8.0 to 5.8.23 (incl.)
  • affected from 6.3.0 to 6.3.14 (incl.)
  • affected from 6.4.0 to 6.4.14 (incl.)
  • affected from 6.5.0 to 6.5.8 (incl.)
  • affected from 7.0.0 to 7.0.3 (incl.)

References