Loading vulnerability…
HTTP Security Header Omission in Spring Security Servlet Applications
CVE-2026-22732 is a protection mechanism failure in Spring Security servlet applications using lazy HTTP response header writing, which is the default behavior. Under certain conditions, configured HTTP response headers are not written, preventing the associated security protections from being applied. Affected versions are 5.7.0–5.7.21, 5.8.0–5.8.23, 6.3.0–6.3.14, 6.4.0–6.4.14, 6.5.0–6.5.8, and 7.0.0–7.0.3. The precise triggering request and vulnerable function are not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Omission of configured security headers can weaken browser-side protections and HTTP caching controls. The resulting exposure depends on which headers are omitted and how the application relies on them. Affected SAP Commerce Cloud and SAP Data Hub deployments are rated Critical with CVSS 9.1, with confidentiality and integrity impacts from unauthenticated remote exploitation without user interaction. Arbitrary code execution and availability impacts are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is established. Restricting network access to affected application endpoints can reduce exposure while updates are deployed, but does not correct the header-writing failure.
Patch, then assume compromise.
Upgrade Spring Security to a vendor-fixed release, including 6.5.9 or later in the 6.5.x branch or 7.0.4 or later in the 7.0.x branch. For other affected branches, obtain the corresponding vendor-fixed release or migrate to a supported fixed branch. For packaged deployments, apply the product vendor's security update rather than independently replacing bundled dependencies. Confirmed updated releases include TKGi 1.23.4 and 1.24.3, Tanzu Data Flow on Tanzu Platform 2.0.6 and 2.1.1, Spring Cloud Data Flow for VMware Tanzu 1.14.13, and Tanzu Data Flow on Kubernetes 2.1.6. Apply the relevant SAP security updates for affected SAP Commerce Cloud and SAP Data Hub installations.
1 exploit validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.