Spring Security Flaw Leaves HTTP Security Headers Unwritten

Spring disclosed CVE-2026-22732, a vulnerability in Spring Security in which HTTP security headers may not be written under certain conditions, weakening browser-side protections that applications rely on to reduce exposure to client-side attacks. The issue affects the framework’s handling of response headers, creating a risk that expected defenses are absent even when developers believe they are enabled.

Belgium’s CCB Safeonweb warned that the flaw can enable multiple types of client-side attacks and urged organizations to patch immediately. The combined advisories indicate that teams using Spring Security should review affected versions, apply vendor fixes, and verify that critical response headers are being sent correctly to browsers after remediation.