This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] VMware Spring fixes 8 vulnerabilities
VMware Spring fixes 8 vulnerabilities found in various products. The most severe vulnerabilities are described below; the remaining ones can be found at [1] by clicking through the individual advisories. Products and their fixed versions: Spring Security - 5.7.22, 5.8.24, 6.3.15, 6.4.15, 6.5.9, 7.0.4 [2] Spring AI - 1.0.4, 1.1.3 [3][4] Spring Cloud Config - 3.1.13, 4.1.9, 4.2.6, 4.3.2, 5.0.2 [5] Spring Framework - 5.3.47, 6.1.26, 6.2.17, 7.0.6 [6][7] Spring Boot - 2.7.32, 3.3.18, 3.4.15, 3.5.12, 4.0.4 [8][9]
Allows an unauthenticated remote attacker, due to incorrect writing of HTTP response headers in applications using Spring Security, to obtain sensitive information [2].
The vulnerability is present in product:
- Spring Security; >=5.7.0, <=5.7.21; >=5.8.0, <=5.8.23, >=6.3.0, <=6.3.14; >=6.4.0, <=6.4.14; >=6.5.0, <=6.5.8; >=7.0.0, <=7.0.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2026-22732 at cve.org, NVD
- CWE-425: Direct Request ('Forced Browsing') at cwe.mitre.org
The vulnerability was publicly disclosed 19. 3. 2026.
Allows an authenticated remote attacker, due to missing input sanitization in the MariaDBFilterExpressionConverter component in Spring AI, to bypass metadata-based access control and execute arbitrary SQL commands [3].
The vulnerability is present in product:
- Spring AI; >=1.0.0, <1.0.4; >=1.1.0, <1.1.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-22730 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 17. 3. 2026.
Allows an unauthenticated remote attacker, due to insufficient escaping of user input in JSONPath queries of the AbstractFilterExpressionConverter component in Spring AI, to bypass metadata-based access control and gain access to unauthorized documents [4].
The vulnerability is present in product:
- Spring AI; >=1.0.0, <1.0.4; >=1.1.0, <1.1.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2026-22729 at cve.org, NVD
- CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 17. 3. 2026.
Allows an unauthenticated remote attacker, due to incorrect substitution of the profile parameter in Spring Cloud Config Server, to access files outside the configured search directories or, when using a repository backend, to perform SSRF attacks [5].
The vulnerability is present in product:
- Spring Cloud Config; >=3.1.0, <3.1.13; >=4.1.0, <4.1.9; >=4.2.0, <4.2.6; >=4.3.0, <4.3.2; >=5.0.0, <5.0.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
More information:
- CVE-2026-22739 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 3. 2026.
Links
- [1] https://spring.io/security
- [2] https://spring.io/security/cve-2026-22732
- [3] https://spring.io/security/cve-2026-22730
- [4] https://spring.io/security/cve-2026-22729
- [5] https://spring.io/security/cve-2026-22739
- [6] https://spring.io/security/cve-2026-22737
- [7] https://spring.io/security/cve-2026-22735
- [8] https://spring.io/security/cve-2026-22733
- [9] https://spring.io/security/cve-2026-22731
By CESNET, z.s.p.o. Michaela Jarošová on 26. 3. 2026.