{"action":"Upgrade org.springframework.security:spring-security-web to 6.5.9 (6.x) or 7.0.4 (7.x) or later.","affected":[{"introduced":"0","last_affected":"5.7.14"},{"introduced":"5.8.0","last_affected":"5.8.16"},{"introduced":"6.0.0","last_affected":"6.3.10"},{"introduced":"6.4.0","last_affected":"6.4.13"},{"fixed":"6.5.9","introduced":"6.5.0"},{"fixed":"7.0.4","introduced":"7.0.0"}],"component":"org.springframework.security:spring-security-web","cve_ids":["CVE-2026-22732"],"ecosystem":"Maven","epss":0.00489,"exploited":false,"fixed_versions":["6.5.9","7.0.4"],"ghsa_id":"GHSA-mf92-479x-3373","id":"tcs_01M5N94ZXV231B704G6XETMWA0","modified_at":"2026-09-10T03:50:40.172563545Z","published_at":"2026-03-20T00:31:28Z","references":["https://osv.dev/vulnerability/GHSA-mf92-479x-3373","https://nvd.nist.gov/vuln/detail/CVE-2026-22732","https://github.com/spring-projects/spring-security","https://spring.io/security/cve-2026-22732"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-mf92-479x-3373","url":"https://osv.dev/vulnerability/GHSA-mf92-479x-3373"}],"summary":"Spring Security HTTP Headers Are not Written Under Some Conditions"}