Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Spring Security's spring-security-web package is affected in versions 5.7.0 through 5.7.21, 5.8.0 through 5.8.23, 6.3.0 through 6.3.14, 6.4.0 through 6.4.14, 6.5.0 through 6.5.8, and 7.0.0 through 7.0.3. In these versions, HTTP response headers that applications configure for servlet applications may not be written under some conditions. The source gives few details about how an attacker would trigger this or what impact it has, though it is rated critical. Upgrade spring-security-web to 6.5.9 or 7.0.4, or to a later release in your line.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 9.1 | Critical | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | CNA (vmware) |
- CISA KEV Not listed.
- EPSS 0.0050, the 43rd percentile, on 11 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:17 UTC First seen by agentprime
- 31 Oct 2026, 14:17 UTC Confirmed by OSV