What is the CVSS score of CVE-2026-22732?

CVE-2026-22732 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Java are affected by CVE-2026-22732?

A critical vulnerability in Spring Security affects multiple versions and prevents proper HTTP security headers from being written to responses, potentially exposing applications to cross-site…. A patch is available.

Is there a public PoC exploit available for CVE-2026-22732?

Yes, a public proof-of-concept exploit is available for CVE-2026-22732. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-22732?

Within 24 hours: Identify all applications using Spring Security versions 5.7.0-5.7.21, 5.8.0-5.8.23, 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.8, or 7.0.0-7.0.3 and assess exposure. Within 7 days: Implement WAF rules to inject critical security headers (X-Frame-Options, X-Content-Type-Options, Content-Security-Policy) at the edge and apply network segmentation to limit affected application exposure. Within 30 days: Monitor Spring Security release channels for patch availability and prepare upgrade plan; conduct security testing to validate compensating controls effectiveness.

Java CVE-2026-22732

EUVD-2026-13347 CRITICAL

Direct Request ('Forced Browsing') (CWE-425)

2026-03-19 vmware

GHSA-mf92-479x-3373

Java Information Disclosure

Critical

Disputed · 9.1 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 04:50 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 19, 2026 - 23:00 euvd

EUVD-2026-13347

Analysis Generated

Mar 19, 2026 - 23:00 vuln.today

CVE Published

Mar 19, 2026 - 22:47 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

279 maven packages depend on org.springframework.security:spring-security-web (240 direct, 39 indirect)

Ecosystem-wide dependent count for version 5.8.0.

DescriptionCVE.org

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

AnalysisAI

Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.7.21, 5.8.0-5.8.23, 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.8, 7.0.0-7.0.3), allowing attackers to bypass security controls that rely on these headers such as HSTS, X-Frame-Options, or CSP policies. This header omission could enable various attacks including clickjacking, man-in-the-middle attacks, or other exploits depending on which protections are intended. No patch is currently available for this critical vulnerability.

Technical ContextAI

Spring Security is a widely-used Java framework that provides authentication and authorization capabilities for Spring-based applications, identified by CPE cpe:2.3:a:spring:spring_security. The vulnerability occurs when applications programmatically set HTTP response headers in servlet environments, where a flaw in the header processing logic may cause these headers to be silently dropped rather than sent to the client. While no specific CWE is assigned, this behavior pattern aligns with improper output handling where security-critical headers fail to be applied, similar to CWE-116 (Improper Encoding or Escaping of Output) or CWE-755 (Improper Handling of Exceptional Conditions).

RemediationAI

Upgrade Spring Security to the latest patched version beyond the affected ranges: version 5.7.22 or later for the 5.7.x branch, 5.8.24 or later for 5.8.x, 6.3.15 or later for 6.3.x, 6.4.15 or later for 6.4.x, 6.5.9 or later for 6.5.x, or 7.0.4 or later for 7.0.x users. Until patching is possible, implement additional security controls outside of Spring Security such as configuring security headers at the web server or load balancer level, and verify critical security headers are present in responses through automated testing. Consult the Spring advisory at https://spring.io/security/cve-2026-22732 for vendor-specific guidance.