Spring Security 5.7.x Release Notes

Bug Fixes

• Capped the inflated size of compressed SAML 2.0 REDIRECT-binding payloads in Saml2Utils, preventing an unauthenticated attacker from exhausting server memory (CVE-2026-40988).
• Hardened the SAML 2.0 filters to route generated HTML forms through FormPostRedirectStrategy, preventing arbitrary code execution via attacker-influenced RelyingPartyRegistration values (CVE-2026-41003).
• Reworked SAML login and logout validation so signature validation gates decryption, closing a decryption-oracle weakness in the OpenSAML authentication and logout providers (CVE-2026-41694).
• Fixed an open-redirect vulnerability in CookieRequestCache and CookieServerRequestCache, which stored and used an unvalidated absolute redirect URL; saved requests now favor relative URIs (CVE-2026-41706).
• Tightened Subject DN parsing in the deprecated SubjectDnX509PrincipalExtractor, preventing a crafted X.509 client certificate from authenticating as another user (CVE-2026-47838).

Dependency Upgrades

• Spring Framework (NES) 5.3.39-spring-framework-5.3.52

Bug Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).

Dependency Upgrades

• Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.21
• Spring Framework (NES) 5.3.39-spring-framework-5.3.51
• Spring LDAP (NES) 2.4.4-spring-ldap-2.4.12

Bug Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 5.3.39-spring-framework-5.3.50

Bug Fixes

• This patches the bug in Spring Security where the maximum password length enforced in the BCryptPasswordEncoder breaks timing attack mitigation in the DaoAuthenticationProvider (CVE-2025-22234).
  • org.springframework.security:spring-security-crypto:5.7.14-spring-security-5.7.18

Bug Fixes

• This patches the bug in Spring Security BCryptPasswordEncoder where maximum password length is not enforced (CVE-2025-22228).
  • org.springframework.security:spring-security-crypto:5.7.14-spring-security-5.7.17

Bug Fixes

• This patches the Spring Security Authorization Bypass for Case Sensitive Comparisons (CVE-2024-38827).
  • com.herodevs.nes.springframework.security:spring-security-cas:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-config:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-core:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-crypto:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-data:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-ldap:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-oauth2-client:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-taglibs:5.7.14-spring-security-5.7.15
  • com.herodevs.nes.springframework.security:spring-security-web:5.7.14-spring-security-5.7.15

Bug Fixes

• This patches the Authorization Bypass of Static Resources in WebFlux Applications (CVE-2024-38821).
  • com.herodevs.nes.springframework.security:spring-security-web:5.7.13-spring-security-5.7.14