Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.springframework.security/spring-security-core@6.0.2
purl pkg:maven/org.springframework.security/spring-security-core@6.0.2
Next non-vulnerable version 6.2.8
Latest non-vulnerable version 7.0.5
Risk 4.5
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-2b4h-659w-77ak
Aliases:
CVE-2024-38827
GHSA-q3v6-hm2v-pw99
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.
6.0.14
Affected by 0 other vulnerabilities.
6.1.12
Affected by 0 other vulnerabilities.
6.2.8
Affected by 0 other vulnerabilities.
6.3.5
Affected by 1 other vulnerability.
VCID-5d1w-2cga-kua7
Aliases:
CVE-2023-34035
GHSA-4vpr-xfrp-cj64
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.) Specifically, an application is vulnerable when all of the following are true: * Spring MVC is on the classpath * Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet) * The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints An application is not vulnerable if any of the following is true: * The application does not have Spring MVC on the classpath * The application secures no servlets other than Spring MVC’s DispatcherServlet * The application uses requestMatchers(String) only for Spring MVC endpoints
6.0.5
Affected by 3 other vulnerabilities.
6.1.2
Affected by 4 other vulnerabilities.
VCID-buca-suya-q3an
Aliases:
CVE-2023-34034
GHSA-3h6f-g5f3-gc4w
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
6.0.5
Affected by 3 other vulnerabilities.
6.1.2
Affected by 4 other vulnerabilities.
VCID-e8tz-73s8-myct
Aliases:
CVE-2024-22257
GHSA-f3jh-qvm4-mg39
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
6.1.8
Affected by 1 other vulnerability.
6.2.3
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T19:47:35.947390+00:00 GitLab Importer Affected by VCID-2b4h-659w-77ak https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework.security/spring-security-core/CVE-2024-38827.yml 38.6.0
2026-06-12T19:23:25.195561+00:00 GitLab Importer Affected by VCID-e8tz-73s8-myct https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework.security/spring-security-core/CVE-2024-22257.yml 38.6.0
2026-06-12T19:00:45.720439+00:00 GitLab Importer Affected by VCID-buca-suya-q3an https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework.security/spring-security-core/CVE-2023-34034.yml 38.6.0
2026-06-12T19:00:41.570783+00:00 GitLab Importer Affected by VCID-5d1w-2cga-kua7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework.security/spring-security-core/CVE-2023-34035.yml 38.6.0