Improper Handling of HTTP Response Headers in Spring Security by Pivotal Software
CVE-2026-22732

9.1CRITICAL

Key Information:

Vendor

Spring

Status
Spring Security
Vendor
CVE Published:
19 March 2026

What is CVE-2026-22732?

The vulnerability exists within Spring Security when applications define HTTP response headers. In certain configurations, these headers may not be written properly, which might lead to unexpected behavior and potential exposure of sensitive information. This impacts multiple versions across the Spring Security framework, indicating a need for vigilant configuration and monitoring to safeguard against potential exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Spring Security 5.7.0 <= 5.7.21

Spring Security 5.8.0 <= 5.8.23

Spring Security 6.3.0 <= 6.3.14

References

https://spring.io/security/cve-2026-22732

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.