Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.springframework.security/spring-security-web@5.4.8
purl pkg:maven/org.springframework.security/spring-security-web@5.4.8
Next non-vulnerable version 6.5.11
Latest non-vulnerable version 7.0.6
Risk score 4.4
Vulnerabilities affecting this package (5)
Advisory Summary Fixed in package version
GHSA-hh32-7344-cg2f
Aliases:
CVE-2022-22978
Authorization bypass in Spring Security In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be …
5.4.11
Vulnerable
GHSA-mf92-479x-3373
Aliases:
CVE-2026-22732
Spring Security HTTP Headers Are not Written Under Some Conditions When applications specify HTTP response headers for servlet applications using … There are no reported fixed by versions.
GHSA-c4q5-6c82-3qpw
Aliases:
CVE-2024-38821
Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications Spring WebFlux applications that have Spring Security authorization …
5.7.13
Vulnerable
5.7.13
Vulnerable
GHSA-293q-567p-wmwq
Aliases:
CVE-2026-47838
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates In Spring Security Web, `SubjectDnX509PrincipalExtractor` does not correctly …
6.5.11
Not vulnerable
GHSA-x2r2-rvhq-2mqv
Aliases:
CVE-2026-41706
Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication …
7.0.6
Not vulnerable
6.5.11
Not vulnerable
This package is not known to fix any advisories.