Spring Security 5.8.x Release Notes

Security Fixes

• An embedded LDAP server started by UnboundIdContainer no longer listens on every network interface with a well-known administrative credential, binding to loopback unless another address is configured (critical severity, CVE-2026-59270).
• Secret-bearing values are no longer compared with timing-variable equality checks in DigestAuthenticationFilter and KeyBasedPersistenceTokenService, which now use a constant-time comparison (medium severity, CVE-2026-59276).
• AesBytesEncryptor and the Encryptors factory methods are now deprecated but still encrypt CBC with an all-zero initialization vector, so identical plaintexts still produce identical ciphertext for a given password and salt; remediation is a migration to the new AesCbcBytesEncryptor or AesGcmBytesEncryptor, which requires re-encrypting existing data (medium severity, CVE-2026-47842).
  • See the guide for more information on migrating to the replacement encryptors.

Dependency Upgrades

• Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.28
• Spring Framework (NES) 5.3.39-spring-framework-5.3.54
• Spring LDAP (NES) 2.4.4-spring-ldap-2.4.14

Security Fixes

• Capped the inflated size of compressed SAML 2.0 REDIRECT-binding payloads in Saml2Utils, preventing an unauthenticated attacker from exhausting server memory (CVE-2026-40988).
• Hardened the SAML 2.0 filters to route generated HTML forms through FormPostRedirectStrategy, preventing arbitrary code execution via attacker-influenced RelyingPartyRegistration values (CVE-2026-41003).
• Reworked SAML login and logout validation so signature validation gates decryption, closing a decryption-oracle weakness in the OpenSAML authentication and logout providers (CVE-2026-41694).
• Fixed an open-redirect vulnerability in CookieRequestCache and CookieServerRequestCache, which stored and used an unvalidated absolute redirect URL; saved requests now favor relative URIs (CVE-2026-41706).
• Tightened Subject DN parsing in the deprecated SubjectDnX509PrincipalExtractor, preventing a crafted X.509 client certificate from authenticating as another user (CVE-2026-47838).

Dependency Upgrades

• Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.27
• Spring Framework (NES) 5.3.39-spring-framework-5.3.52
• Spring LDAP (NES) 2.4.4-spring-ldap-2.4.13

Security Fixes

• Patched the authorization bypass in DaoAuthenticationProvider where timing attack protections could be circumvented for disabled, expired, or locked accounts when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked (CVE-2026-22746).

Dependency Upgrades

• Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.26
• Spring Framework (NES) 5.3.39-spring-framework-5.3.51
• Spring LDAP (NES) 2.4.4-spring-ldap-2.4.12

Security Fixes

• Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

• Spring Framework (NES) 5.3.39-spring-framework-5.3.50

Security Fixes

• This patches the bug in Spring Security where the maximum password length enforced in the BCryptPasswordEncoder (patch for CVE-2025-22228) breaks timing attack mitigation in the DaoAuthenticationProvider (CVE-2025-22234).
  • org.springframework.security:spring-security-crypto:5.8.16-spring-security-5.8.21

Security Fixes

• This patches the bug in Spring Security BCryptPasswordEncoder where maximum password length is not enforced (CVE-2025-22228).
  • org.springframework.security:spring-security-crypto:5.8.16-spring-security-5.8.20

Security Fixes

• This patches the Spring Security Authorization Bypass for Case Sensitive Comparisons (CVE-2024-38827).
  • com.herodevs.nes.springframework.security:spring-security-cas:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-config:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-core:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-crypto:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-data:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-ldap:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-oauth2-client:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-taglibs:5.8.16-spring-security-5.8.17
  • com.herodevs.nes.springframework.security:spring-security-web:5.8.16-spring-security-5.8.17

Security Fixes

• This patches the Authorization Bypass of Static Resources in WebFlux Applications (CVE-2024-38821).
  • com.herodevs.nes.springframework.security:spring-security-web:5.8.15-spring-security-5.8.16