Spring Security 4.2.x Release Notes

Security Fixes

• An embedded LDAP server started by UnboundIdContainer no longer listens on every network interface with a well-known administrative credential, binding to loopback unless another address is configured (critical severity, CVE-2026-59270).
• Secret-bearing values are no longer compared with timing-variable equality checks in DigestAuthenticationFilter and KeyBasedPersistenceTokenService, which now use a constant-time comparison (medium severity, CVE-2026-59276).
• AesBytesEncryptor and the Encryptors factory methods are now deprecated but still encrypt CBC with an all-zero initialization vector, so identical plaintexts still produce identical ciphertext for a given password and salt; remediation is a migration to the new AesCbcBytesEncryptor or AesGcmBytesEncryptor, which requires re-encrypting existing data (medium severity, CVE-2026-47842).
  • See the guide for more information on migrating to the replacement encryptors.

Dependency Upgrades

• Spring Framework (NES) 4.3.30-spring-framework-4.3.40

Security Fixes

• Tightened Subject DN parsing in the deprecated SubjectDnX509PrincipalExtractor, preventing a remote attacker presenting a crafted X.509 client certificate from being authenticated as another user (CVE-2026-47838).

Dependency Upgrades

• Spring Framework (NES) 4.3.30-spring-framework-4.3.39

Security Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).

Dependency Upgrades

• Spring Framework (NES) 4.3.30-spring-framework-4.3.38

Security Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 4.3.30-spring-framework-4.3.37

Security Fixes

• This patches the bug in Spring Security where the maximum password length enforced in the BCryptPasswordEncoder (patch for CVE-2025-22228) breaks timing attack mitigation in the DaoAuthenticationProvider (CVE-2025-22234).
  • org.springframework.security:spring-security-crypto:4.2.20-spring-security-4.2.25

Security Fixes

• This patches the bug in Spring Security BCryptPasswordEncoder where maximum password length is not enforced (CVE-2025-22228).
  • org.springframework.security:spring-security-crypto:4.2.20-spring-security-4.2.24

Security Fixes

• This release patches the following:
  • Changing SecurityContext More Than Once in Single Request Can Fail to Save (CVE-2021-22112).
    • com.herodevs.nes.springframework.security:spring-security-web:4.2.20-spring-security-4.2.22
  • Authorization Bypass in RegexRequestMatcher (CVE-2022-22978).
    • com.herodevs.nes.springframework.security:spring-security-core:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-web:4.2.20-spring-security-4.2.22
  • Possible Broken Access Control in Spring Security With Direct Use of AuthenticatedVoter (CVE-2024-22257).
    • com.herodevs.nes.springframework.security:spring-security-core:4.2.20-spring-security-4.2.22
  • Spring Security Authorization Bypass for Case Sensitive Comparisons (CVE-2024-38827).
    • com.herodevs.nes.springframework.security:spring-security-cas:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-config:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-core:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-crypto:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-ldap:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-taglibs:4.2.20-spring-security-4.2.22
    • com.herodevs.nes.springframework.security:spring-security-web:4.2.20-spring-security-4.2.22

Notes

• Spring Security 4.2.22 NES release updates Spring Framework to NES version 4.3.32.