Spring Security Flaw Leaves HTTP Security Headers Unwritten
Spring disclosed CVE-2026-22732, a vulnerability in Spring Security in which HTTP security headers may not be written under certain conditions, weakening browser-side protections that applications rely on to reduce exposure to client-side attacks. The issue affects the framework’s handling of response headers, creating a risk that expected defenses are absent even when developers believe they are enabled.
Belgium’s CCB Safeonweb warned that the flaw can enable multiple types of client-side attacks and urged organizations to patch immediately. The combined advisories indicate that teams using Spring Security should review affected versions, apply vendor fixes, and verify that critical response headers are being sent correctly to browsers after remediation.
Timeline
Mar 20, 2026
Belgium CCB warns of client-side attacks in Spring Security and urges patching
The Belgian Centre for Cybersecurity published an advisory warning about multiple types of client-side attacks affecting Spring Security and told organizations to patch immediately.
Nov 1, 2024
Spring publishes advisory for CVE-2026-22732 in Spring Security
Spring issued a product security advisory for CVE-2026-22732, describing a flaw where Spring Security HTTP headers are not written under some conditions.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Vulnerabilities
Affected Products
Sources
Related Stories
Thymeleaf SSTI Bypass Enables Expression Injection in Spring Java Apps
A critical flaw tracked as **`CVE-2026-40478`** allows attackers to bypass Thymeleaf’s expression-injection protections and achieve **server-side template injection (SSTI)** in applications that pass unvalidated user input into the template engine. The vulnerability affects **Thymeleaf 3.1.3.RELEASE and earlier** and stems from improper neutralization of syntax patterns in expression execution, including a whitespace parsing mismatch that let attackers evade detection of the SpEL `new` keyword and an incomplete type blocklist that still allowed dangerous class instantiation. The issue is mapped to **`CWE-917`** and **`CWE-1336`**, with a published **CVSS v3.1** vector of **`AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`**. Researchers said successful exploitation can enable arbitrary file writes and potentially remote code execution in **Spring-based Java applications**, where Thymeleaf is commonly used as the default template engine in Spring Boot. The flaw can be exploited remotely without authentication when attacker-controlled input reaches Thymeleaf expression parsing, view names, or fragment selectors. The issue is addressed in **`3.1.4.RELEASE`**, which normalizes whitespace before checks, expands external-access detection, restricts dangerous expression objects, and tightens type restrictions; defenders are urged to upgrade **`thymeleaf`**, **`thymeleaf-spring5`**, and **`thymeleaf-spring6`** and review applications to ensure untrusted input is never interpreted as template expressions.
1 weeks ago
Spring fixes TLS hostname verification flaws and DevTools timing attack issue
Spring published advisories for four vulnerabilities affecting its ecosystem, including three flaws in auto-configuration for **Elasticsearch**, **Cassandra**, and **RabbitMQ** that can disable TLS hostname verification when an SSL bundle is used. The issues are tracked as `CVE-2026-40970`, `CVE-2026-40974`, and `CVE-2026-40971`, respectively, and could weaken certificate validation for connections to those backend services. A fourth advisory, `CVE-2026-40972`, affects **Spring DevTools** and states that remote secret comparison is vulnerable to timing attacks. Together, the disclosures highlight risks in both transport security and authentication-related logic, with the TLS-related bugs potentially exposing applications to man-in-the-middle scenarios and the DevTools issue creating an avenue for attackers to infer secrets through response timing differences.
1 weeks ago
Spring Issues Security Updates Across Boot, Framework, Security, and Gateway
Spring published multiple security advisories covering several widely used components, including **Spring Cloud Gateway**, **Spring Security**, **Spring Authorization Server**, **Spring Framework**, and a critical update for **Spring Boot**. The Canadian Centre for Cyber Security said the advisories were released between April 9 and April 23 and identified affected version ranges across these product lines, with Spring Boot fixes specifically issued for the `4.0.x`, `3.5.x`, `3.4.x`, `3.3.x`, and `2.7.x` release branches. Canadian authorities urged organizations to review the referenced Spring advisories and apply the vendor updates for all impacted deployments. The notices describe the issue as a patching and vulnerability-management matter rather than confirmed active exploitation, but they emphasize that administrators should promptly update affected Spring environments to the patched versions listed by the vendor.
1 weeks ago