Spring EUVD-2026-13347

Remote unauthenticated attacker against Spring Security servlet applications versions 5.7.0-5.7.21, 5.8.0-5.8.23, 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.8, 7.0.0-7.0.3 where HTTP response headers are configured but fail to write, enabling header injection attacks. No user interaction required.

Despite the critical CVSS 9.1 score driven by network accessibility (AV:N), low complexity (AC:L), and high confidentiality/integrity impact, the real-world risk requires nuanced evaluation. The vulnerability requires no authentication (PR:N) and no user interaction (UI:N), making it easily exploitable if targeted. However, with no KEV listing, no known public exploits, and no EPSS data available, actual exploitation appears limited. The high impact stems from potential bypass of security headers rather than direct data compromise, making this a priority for organizations relying heavily on header-based security controls but potentially lower risk for those with defense-in-depth strategies. The SSVC framework would likely classify this as 'Attend' rather than 'Act' given the lack of active exploitation evidence.

An attacker could send requests to a vulnerable Spring Security application where security headers like Content-Security-Policy, X-Frame-Options, or Strict-Transport-Security fail to be applied, enabling clickjacking attacks, XSS exploitation, or protocol downgrade attacks that would normally be prevented. The network-based attack requires no authentication and could be automated to scan for missing headers across multiple endpoints. While no public proof-of-concept exists, the straightforward nature of header verification makes this vulnerability easily discoverable through basic security testing.