CVE-2026-22753: Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers
Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests.This issue affects Spring Security: from 7.0.0 through 7.0.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22753?
CVE-2026-22753 has been rated as a medium severity vulnerability.
What is the impact of CVE-2026-22753 on applications using Spring Security?
CVE-2026-22753 can cause matching requests to a filter chain to fail, impacting the security of applications using affected versions.
How do I fix CVE-2026-22753?
To address CVE-2026-22753, upgrade Spring Security to version 7.0.5 or later.
Which versions of Spring Security are affected by CVE-2026-22753?
Spring Security versions from 7.0.0 to 7.0.4 are vulnerable to CVE-2026-22753.
What are the conditions for the occurrence of CVE-2026-22753?
CVE-2026-22753 occurs when applications incorrectly configure security matchers using the securityMatchers(String) method along with a PathPatternRequestMatcher.Builder.