VulnerableCode Package Details - pkg:maven/org.springframework.security/spring-security-core@5.8.3

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.springframework.security/spring-security-core@5.8.3

purl	pkg:maven/org.springframework.security/spring-security-core@5.8.3

Next non-vulnerable version	6.2.8
Latest non-vulnerable version	7.0.5
Risk score	3.7

Vulnerabilities affecting this package (5)

Advisory	Summary	Fixed in package version
GHSA-q3v6-hm2v-pw99 Aliases: CVE-2024-38827	Spring Framework has Authorization Bypass for Case Sensitive Comparisons The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions …	5.8.16 Vulnerable
GHSA-f3jh-qvm4-mg39 Aliases: CVE-2024-22257	Erroneous authentication pass in Spring Security In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x …	5.8.11 Vulnerable
CVE-2023-34034	Improper Handling of Inconsistent Structural Elements Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch …	5.6.12 Vulnerable 5.7.10 Vulnerable 5.8.5 Vulnerable 6.0.5 Vulnerable 6.1.2 Vulnerable
CVE-2023-34035	Incorrect Authorization Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be …	5.8.5 Vulnerable 6.0.5 Vulnerable 6.1.2 Vulnerable
GHSA-vxf7-qj7q-83fh Aliases: CVE-2026-22746	Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider Vulnerability in Spring Spring Security. If an application is using …	6.5.10 Not vulnerable 7.0.5 Not vulnerable

Vulnerabilities fixed by this package (1)

Advisory	Summary	Aliases
GHSA-x873-6rgc-94jc	Spring Security logout not clearing security context In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, …	CVE-2023-20862