Spring Security Release Notes

Bug Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).
• Patched the weak authentication issue in NimbusJwtDecoder and NimbusReactiveJwtDecoder where JWT token validation is not enforced unless an OAuth2TokenValidator<Jwt> is explicitly configured via setJwtValidator() (CVE-2026-22748).
• Patched the authorization bypass in JdbcOneTimeTokenService where a time-of-check time-of-use race condition allowed concurrent one-time token login requests to bypass the single-use constraint (CVE-2026-22751).

Dependency Upgrades

• Spring Data BOM (NES) 2024.1.13-spring-data-bom-2024.1.16
• Spring LDAP (NES) 3.2.16-spring-ldap-3.2.20

Bug Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).
• Patched the weak authentication issue in NimbusJwtDecoder and NimbusReactiveJwtDecoder where JWT token validation is not enforced unless an OAuth2TokenValidator<Jwt> is explicitly configured via setJwtValidator() (CVE-2026-22748).

Dependency Upgrades

• Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.16
• Spring Framework (NES) 6.1.21-spring-framework-6.1.27
• Spring LDAP (NES) 3.2.16-spring-ldap-3.2.20

Bug Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).
• Patched the weak authentication issue in NimbusJwtDecoder and NimbusReactiveJwtDecoder where JWT token validation is not enforced unless an OAuth2TokenValidator<Jwt> is explicitly configured via setJwtValidator() (CVE-2026-22748).

Dependency Upgrades

• Spring Data BOM (NES) 2023.1.12-spring-data-bom-2023.1.18
• Spring Framework (NES) 6.1.21-spring-framework-6.1.27
• Spring LDAP (NES) 3.2.16-spring-ldap-3.2.20

Bug Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).

Dependency Upgrades

• Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.26
• Spring Framework (NES) 5.3.39-spring-framework-5.3.51
• Spring LDAP (NES) 2.4.4-spring-ldap-2.4.12

Bug Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).

Dependency Upgrades

• Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.21
• Spring Framework (NES) 5.3.39-spring-framework-5.3.51
• Spring LDAP (NES) 2.4.4-spring-ldap-2.4.12

Bug Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.15
• Spring Framework (NES) 5.3.39-spring-framework-5.3.51
• Spring LDAP (NES) 2.3.8-spring-ldap-2.3.11

Bug Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).

Dependency Upgrades

• Spring Framework (NES) 4.3.30-spring-framework-4.3.38

Bug Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework 6.2.17
• Spring Data BOM (NES) 2024.1.13-spring-data-bom-2024.1.14
• Spring LDAP (NES) 3.2.16-spring-ldap-3.2.18

Bug Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 6.1.21-spring-framework-6.1.26

Bug Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 6.1.21-spring-framework-6.1.26

Bug Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 5.3.39-spring-framework-5.3.50

Bug Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 5.3.39-spring-framework-5.3.50

Bug Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 5.3.39-spring-framework-5.3.50

Bug Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 4.3.30-spring-framework-4.3.37

Bug Fixes

• This release patches the following:
  • Maximum password length enforced in BCryptPasswordEncoder (patch for CVE-2025-22228) breaks timing attack mitigation in DaoAuthenticationProvider (CVE-2025-22234).
  • BCryptPasswordEncoder maximum password length is not enforced (CVE-2025-22228).
  • Authorization Bypass for Case Sensitive Comparisons (CVE-2024-38827).
  • Authorization Bypass of Static Resources in WebFlux Applications (CVE-2024-38821).
  • Possible Broken Access Control With Direct Use of AuthenticatedVoter (CVE-2024-22257).
  • Privilege Escalation in OAuth2 Client (CVE-2022-31690).

Notes

• This release originates from the open‑source Spring Security repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Security 5.5.8.

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.13
• Spring Framework (NES) 5.3.39-spring-framework-5.3.49
• Spring LDAP (NES) 2.3.8-spring-ldap-2.3.9

Bug Fixes

• This release patches the following:
  • CVE-2025-22234: Maximum password length enforced in the BCryptPasswordEncoder (patch for CVE-2025-22228) breaks timing attack mitigation in the DaoAuthenticationProvider.
    • org.springframework.security:spring-security-crypto:6.2.8-spring-security-6.2.9
  • CVE-2025-22228: Maximum password length is not enforced in BCryptPasswordEncoder
    • org.springframework.security:spring-security-crypto:6.2.8-spring-security-6.2.9

Notes

• This release originates from the open‑source Spring Security repository forked by HeroDevs starting with version 6.2.8.
• Includes other modifications implemented by HeroDevs to ensure successful library builds. Full Version: 6.2.8-spring-security-6.2.9

Bug Fixes

• This patches the bug in Spring Security where the maximum password length enforced in the BCryptPasswordEncoder (patch for CVE-2025-22228) breaks timing attack mitigation in the DaoAuthenticationProvider (CVE-2025-22234).
  • org.springframework.security:spring-security-crypto:4.2.20-spring-security-4.2.25

Bug Fixes

• This patches the bug in Spring Security where the maximum password length enforced in the BCryptPasswordEncoder (patch for CVE-2025-22228) breaks timing attack mitigation in the DaoAuthenticationProvider (CVE-2025-22234).
  • org.springframework.security:spring-security-crypto:5.8.16-spring-security-5.8.21

Bug Fixes

• This patches the bug in Spring Security where the maximum password length enforced in the BCryptPasswordEncoder breaks timing attack mitigation in the DaoAuthenticationProvider (CVE-2025-22234).
  • org.springframework.security:spring-security-crypto:5.7.14-spring-security-5.7.18

Bug Fixes

• This patches the bug in Spring Security BCryptPasswordEncoder where maximum password length is not enforced (CVE-2025-22228).
  • org.springframework.security:spring-security-crypto:5.8.16-spring-security-5.8.20

Bug Fixes

• This patches the bug in Spring Security BCryptPasswordEncoder where maximum password length is not enforced (CVE-2025-22228).
  • org.springframework.security:spring-security-crypto:5.7.14-spring-security-5.7.17

Bug Fixes

• This patches the bug in Spring Security BCryptPasswordEncoder where maximum password length is not enforced (CVE-2025-22228).
  • org.springframework.security:spring-security-crypto:4.2.20-spring-security-4.2.24

Bug Fixes

• This release patches the following:
  • Changing SecurityContext More Than Once in Single Request Can Fail to Save (CVE-2021-22112).
    • com.herodevs.nes.springframework.security:spring-security-web:4.2.20-spring-security-4.2.22
  • Authorization Bypass in RegexRequestMatcher (CVE-2022-22978).
    • com.herodevs.nes.springframework.security:spring-security-core:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-web:4.2.20-spring-security-4.2.22
  • Possible Broken Access Control in Spring Security With Direct Use of AuthenticatedVoter (CVE-2024-22257).
    • com.herodevs.nes.springframework.security:spring-security-core:4.2.20-spring-security-4.2.22
  • Spring Security Authorization Bypass for Case Sensitive Comparisons (CVE-2024-38827).
    • com.herodevs.nes.springframework.security:spring-security-cas:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-config:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-core:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-crypto:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-ldap:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-taglibs:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-web:4.2.20-spring-security-4.2.22

Notes

• Spring Security 4.2.22 NES release updates Spring Framework to NES version 4.3.32.

Bug Fixes

• This patches the Spring Security Authorization Bypass for Case Sensitive Comparisons (CVE-2024-38827).
  • com.herodevs.nes.springframework.security:spring-security-cas:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-config:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-core:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-crypto:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-data:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-ldap:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-oauth2-client:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-taglibs:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-web:5.8.16-spring-security-5.8.17

Bug Fixes

• This patches the Spring Security Authorization Bypass for Case Sensitive Comparisons (CVE-2024-38827).
  • com.herodevs.nes.springframework.security:spring-security-cas:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-config:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-core:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-crypto:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-data:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-ldap:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-oauth2-client:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-taglibs:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-web:5.7.14-spring-security-5.7.15

Bug Fixes

• This patches the Authorization Bypass of Static Resources in WebFlux Applications (CVE-2024-38821).
  • com.herodevs.nes.springframework.security:spring-security-web:5.8.15-spring-security-5.8.16

Bug Fixes

• This patches the Authorization Bypass of Static Resources in WebFlux Applications (CVE-2024-38821).
  • com.herodevs.nes.springframework.security:spring-security-web:5.7.13-spring-security-5.7.14