Improper Handling of HTTP Response Headers in Spring Security by Pivotal Software
CVE-2026-22732

9.1CRITICAL

Key Information:

Vendor

Vmware
Status
Spring Security
Vendor
CVE Published:
19 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-22732?

The vulnerability exists within Spring Security when applications define HTTP response headers. In certain configurations, these headers may not be written properly, which might lead to unexpected behavior and potential exposure of sensitive information. This impacts multiple versions across the Spring Security framework, indicating a need for vigilant configuration and monitoring to safeguard against potential exploits.

Affected Version(s)

Spring Security 5.7.0 <= 5.7.21

Spring Security 5.7.0 <= 5.7.21

Spring Security 5.8.0 <= 5.8.23

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2026-22732-demo
Created by semgrep

References

https://spring.io/security/cve-2026-22732

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.