CVE-2026-22732
CRITICALUnder Some Conditions Spring Security HTTP Headers Are not Written
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-22732. PoCs published by semgrep.
AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2026-22732, demonstrating how Spring Security HTTP response headers are silently dropped when controller code writes directly to the servlet response. It includes vulnerable endpoints and tests to verify the presence or absence of security headers.
Description
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
Exploits (1)
This repository contains a functional proof-of-concept for CVE-2026-22732, demonstrating how Spring Security HTTP response headers are silently dropped when controller code writes directly to the servlet response. It includes vulnerable endpoints and tests to verify the presence or absence of security headers.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N