Insecure String Comparison in Spring Security Affects Multiple Versions
CVE-2026-59276

5.9MEDIUM

Key Information:

Vendor

Spring

Status
Spring Security
Vendor
CVE Published:
27 August 2026

What is CVE-2026-59276?

Several components in Spring Security utilize standard string equality (String.equals()) for comparing security-sensitive values. This approach can lead to timing attacks, as the time taken to reject incorrect values depends on how many leading characters match the expected value. To mitigate this vulnerability, it is essential to implement constant-time comparison methods that ensure consistent timing, regardless of input matches.

Affected Version(s)

Spring Security 7.1.0

Spring Security 7.0.0 <= 7.0.6

Spring Security 6.5.0 <= 6.5.11

References

https://spring.io/security/cve-2026-59276

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.