CRITICAL CWE-425
CVE-2026-22732
Under Some Conditions Spring Security HTTP Headers Are not Written
VMware·Spring Security
9.1/ 10
CVSS 3.1
Critical severity
0.50%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 43% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Mar 19, 2026
- Updated
- Apr 2, 2026
- First covered
- Aug 16, 2026
- Latest story
- 3 months ago
Summary
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
CWE-425Direct Request ('Forced Browsing')
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NAffected products
- VMware Spring Security5.7.0 to 5.7.215.8.0 to 5.8.236.3.0 to 6.3.146.4.0 to 6.4.14