CVE-2026-22753 — Protection Mechanism Failure in Spring Security

CWE-693 — Protection Mechanism FailureCWE-551 — Incorrect Behavior Order: Authorization Before Parsing and Canonicalization4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 79.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Spring SecurityDevspaces Openvsx-rhel9Devspaces Pluginregistry-rhel9+3 more
Timeline
PublishedApr 22

Description

Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests.This issue affects Spring Security: from 7.0.0 through 7.0.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5spring/spring_security7.0.0 — 7.0.4
▶Red Hatjenkins/jenkins

🔴Vulnerability Details

1
GHSA
GHSA-4wrg-8wpc-h923: Vulnerability in Spring Spring Security↗2026-04-22
▶

📋Vendor Advisories

1
Red Hat
Spring Security: Spring Security: Security bypass due to incorrect servlet path matching↗2026-04-22
▶

💬Community

1
Bugzilla
CVE-2026-22753 Spring Security: Spring Security: Security bypass due to incorrect servlet path matching↗2026-04-22
▶