Vulnerability Intelligence Report
Under Some Conditions Spring Security HTTP Headers Are not Written
CVE-2026-22732
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
No Active Exploit Signals
CVSS Base Score
9.1
CRITICAL
Exploitability:3.9
Impact Score:5.2
EPSS Probability:0.48%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-425 ↗CWE-425 Direct Request ('Forced Browsing')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| VMware | Spring Security | 5.7.0 <= 5.7.21 (affected), 5.8.0 <= 5.8.23 (affected), 6.3.0 <= 6.3.14 (affected), 6.4.0 <= 6.4.14 (affected), 6.5.0 <= 6.5.8 (affected), 7.0.0 <= 7.0.3 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.480%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VMware by Broadcom · Vendor · USA |
| Reserved | 2026-01-09T06:54:41 |
| Published | 2026-03-19T22:47:38 |
| Last Updated | 2026-04-02T07:20:58 |
Community Chatter & Buzz