CVE-2026-59276
published 2026-08-27CVE-2026-59276: Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.33%
25.2th percentile
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| spring | spring_security | — | — |
| spring | spring_security | 5.7.0 – 5.7.25 | — |
| spring | spring_security | 5.8.0 – 5.8.27 | — |
| spring | spring_security | 6.4.0 – 6.4.18 | — |
| spring | spring_security | 6.5.0 – 6.5.11 | — |
| spring | spring_security | 7.0.0 – 7.0.6 | — |
| vmware | spring_security | >= 5.7.0 < 5.7.26 | 5.7.26 |
| vmware | spring_security | >= 5.8.0 < 5.8.28 | 5.8.28 |
| vmware | spring_security | >= 6.4.0 < 6.4.19 | 6.4.19 |
| vmware | spring_security | >= 6.5.0 < 6.5.12 | 6.5.12 |
| vmware | spring_security | >= 7.0.0 < 7.0.6.1 | 7.0.6.1 |
| vmware | spring_security | >= 7.1.0 < 7.1.0.1 | 7.1.0.1 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.springframework.security/spring-security-core: Spring Security: Information disclosure via timing attack in sensitive value comparison
vendor_redhat·2026-08-27·CVSS 5.9
CVE-2026-59276 [MEDIUM] CWE-208 org.springframework.security/spring-security-core: Spring Security: Information disclosure via timing attack in sensitive value comparison
org.springframework.security/spring-security-core: Spring Security: Information disclosure via timing attack in sensitive value comparison
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals())
VulDB
VMware Spring Security up to 7.1.0 String.equals timing discrepancy
vuldb·2026-08-27·CVSS 5.9
CVE-2026-59276 [MEDIUM] VMware Spring Security up to 7.1.0 String.equals timing discrepancy
A vulnerability has been found in VMware Spring Security up to 7.1.0 and classified as problematic. Impacted is the function String.equals. Performing a manipulation results in observable timing discrepancy.
This vulnerability is reported as CVE-2026-59276. The attack is possible to be carried out remotely. No exploit exists.
GHSA
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison.
ghsa_unreviewed·2026-08-27
CVE-2026-59276 [MEDIUM] CWE-208 Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison.
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
No detection rules found.
No public exploits indexed.
2026-08-27
Published