Spring · product
Spring Security
29 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 29 is a mark on the map. Named now: 1 to 26, most at risk first.
- Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security
- PlaintextPasswordEncoder authenticates encoded passwords that are null
- CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated
- CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
- CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length
- Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected…
- Missing Authorization When Using @AuthorizeReturnObject
- Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
- Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
- Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
- Authentication Bypass under Actuator CloudFoundry endpoints
- WebAuthn User Verification Bypass via Session Serialization
- Timing Attack via Non-Constant-Time Comparison of Sensitive Values
- Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
- Spring Security InetAddressMatchers Incomplete Internal Network Classification
- Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
- ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules
- Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers
- Unauthorized User Impersonation when Using X.509 Client Certificates
- User Attribute Enumeration when Using DaoAuthenticationProvider
- Open Redirect When Using CookieRequestCache
- Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
- Potential Security Misconfiguration when Using withIssuerLocation
- Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry
- Spring Security Authorization Server Open Redirect via request_uri
- Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.