Vulnerability Directory | CVE-2026-22732 | Spring

Overview

Spring Security is a powerful and highly customizable authentication and access-control framework for Java applications built on the Spring Framework. It provides comprehensive security services for Java EE-based enterprise software applications, including authentication, authorization, and protection against common exploits.

A critical-severity vulnerability (CVE-2026-22732) has been identified in Spring Security's OnCommittedResponseWrapper class. The wrapper fails to override the setHeader, setIntHeader, and addIntHeader methods from HttpServletResponse, which means that when Content-Length is set using any of these methods, the response body length is not tracked. This causes the HTTP response to be committed (sent to the client) before Spring Security can write its security headers, resulting in security-critical response headers being silently omitted. Missing headers can include CSRF tokens, session cookie security flags, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and other protections, potentially leading to authentication bypass, clickjacking, cross-site scripting, or other attacks that depend on the absence of these defenses.

Security Misconfiguration can happen at any level of an application stack, including missing appropriate security hardening or improperly configured permissions. The application might be vulnerable if the application is missing appropriate security hardening across any part of the application stack or improperly configured permissions on cloud services.

This issue affects multiple versions of Spring Security.

‍

Details

Module Info

Product: Spring Security
Affected packages: spring-security-web
Affected versions: >=4.0.2 <6.5.9, >=7.0.0 <7.0.4
GitHub repository: https://github.com/spring-projects/spring-security
Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-web
Package manager: Maven
Fixed in:
- OSS versions: 6.5.x, 7.0.x
- NES for Spring Security

‍

Vulnerability Info

This critical-severity vulnerability is found in the OnCommittedResponseWrapper class within the spring-security-web module across all published versions of Spring Security prior to the fix.

OnCommittedResponseWrapper is a core component of Spring Security's response handling pipeline. It wraps HttpServletResponse to intercept response operations, ensuring that security headers and session attributes are written before the response is committed (i.e., flushed to the client). Once a response is committed, no further headers can be added.

The wrapper tracks the Content-Length of the response body to detect when the response is about to be committed. However, the HttpServletResponse interface provides four methods for setting HTTP headers:

addHeader(String name, String value) was overridden and tracked Content-Length
setHeader(String name, String value) was NOT overridden
setIntHeader(String name, int value) was NOT overridden
addIntHeader(String name, int value) was NOT overridden

Because three of these four methods were not overridden, any code path that sets the Content-Length header via setHeader, setIntHeader, or addIntHeader bypasses Spring Security's body length tracking entirely. When this happens, the underlying servlet container commits the response based on the Content-Length value it received directly, without Spring Security being aware. The response is flushed to the client before Spring Security's filter chain has a chance to write security response headers.

This was demonstrated in a real-world scenario reported in Spring Framework issue #36381. When Spring Framework 7.0.5 optimized its internal header handling (changing from addHeader to setHeader for Content-Length), Spring Security's response headers were silently dropped. The affected headers included:

‍

- X-Content-Type-Options: nosniff
- X-XSS-Protection: 0
- Cache-Control: no-cache, no-store, max-age=0, must-revalidate
- Pragma: no-cache
- Expires: 0
- X-Frame-Options: DENY
- Content-Security-Policy: default-src 'self'

‍

The loss of these headers can have severe consequences: X-Frame-Options and Content-Security-Policy protect against clickjacking and cross-site scripting; Cache-Control headers prevent sensitive data from being cached; CSRF tokens delivered via headers would be missing, potentially allowing cross-site request forgery attacks.

The fix adds overrides for the three missing methods. Each override calls a new private helper method checkContentLengthHeader that detects when Content-Length is being set and delegates to setContentLength() to enable body length tracking, consistent with the existing behavior in addHeader.

‍

Mitigation

Only recent versions of Spring Security receive community support and updates. Older versions have no publicly available fixes for this vulnerability.

Users of the affected components should apply one of the following mitigations: