Spring Security 5.5.x Release Notes

Bug Fixes

• Capped the inflated size of compressed SAML 2.0 REDIRECT-binding payloads in Saml2Utils, preventing an unauthenticated attacker from exhausting server memory (CVE-2026-40988).
• Hardened the SAML 2.0 filters to route generated HTML forms through FormPostRedirectStrategy, preventing arbitrary code execution via attacker-influenced RelyingPartyRegistration values (CVE-2026-41003).
• Reworked SAML login and logout validation so signature validation gates decryption, closing a decryption-oracle weakness in the OpenSAML authentication and logout providers (CVE-2026-41694).
• Fixed an open-redirect vulnerability in CookieRequestCache and CookieServerRequestCache, which stored and used an unvalidated absolute redirect URL; saved requests now favor relative URIs (CVE-2026-41706).
• Tightened Subject DN parsing in the deprecated SubjectDnX509PrincipalExtractor, preventing a crafted X.509 client certificate from authenticating as another user (CVE-2026-47838).

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.16
• Spring Framework (NES) 5.3.39-spring-framework-5.3.52
• Spring LDAP (NES) 2.3.8-spring-ldap-2.3.12

Bug Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.15
• Spring Framework (NES) 5.3.39-spring-framework-5.3.51
• Spring LDAP (NES) 2.3.8-spring-ldap-2.3.11

Bug Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 5.3.39-spring-framework-5.3.50

Bug Fixes

• This release patches the following:
  • Maximum password length enforced in BCryptPasswordEncoder (patch for CVE-2025-22228) breaks timing attack mitigation in DaoAuthenticationProvider (CVE-2025-22234).
  • BCryptPasswordEncoder maximum password length is not enforced (CVE-2025-22228).
  • Authorization Bypass for Case Sensitive Comparisons (CVE-2024-38827).
  • Authorization Bypass of Static Resources in WebFlux Applications (CVE-2024-38821).
  • Possible Broken Access Control With Direct Use of AuthenticatedVoter (CVE-2024-22257).
  • Privilege Escalation in OAuth2 Client (CVE-2022-31690).

Notes

• This release originates from the open‑source Spring Security repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Security 5.5.8.

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.13
• Spring Framework (NES) 5.3.39-spring-framework-5.3.49
• Spring LDAP (NES) 2.3.8-spring-ldap-2.3.9