Skip to content
OpenAdvisories

Product · Spring

Spring Security

29 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-59277

    Spring Security InetAddressMatchers Incomplete Internal Network Classification

    Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7…

    Spring Spring Security
  • Low 3.7
    CVE-2026-41694

    SAML Payloads Decrypted Without Valid Signature

    Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affe…

    Spring Spring Security org.springframework.security:spring-security-saml2-service-provider Maven
  • Low 3.7
    CVE-2026-22746

    User Attribute Enumeration when Using DaoAuthenticationProvider

    Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypass…

    Spring Spring Security org.springframework.security:spring-security-core Maven
  • Low 3.8
    CVE-2019-3795

    Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

    Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest ap…

    Spring Spring Security org.springframework.security:spring-security-core Maven