VMware Spring Security Content-Length header suppression (CVE-2026-22732)

CVE-2026-22732 is a vulnerability in Spring Security where specific methods for setting the 'Content-Length' header bypass the 'OnCommittedResponseWrapper'. This prevents the wrapper from triggering 'onResponseCommitted()', causing the framework to fail to inject essential security headers such as 'X-Frame-Options', 'X-Content-Type-Options', and 'Cache-Control'. This vulnerability affects multiple versions of Spring Security. Fixes are available in versions 6.5.9 and 7.0.4; for versions where an upgrade is not possible, a 'BeanPostProcessor' configuration can be applied to force eager header writing.

Impact

Successful exploitation results in the suppression of critical security headers. This exposes applications to various web-based attacks that rely on the absence of browser-side security policies, such as clickjacking (due to missing 'X-Frame-Options') or MIME-sniffing attacks (due to missing 'X-Content-Type-Options').

Recommendation

• Upgrade Spring Security to the patched versions: 6.5.9 or 7.0.4.
• If upgrading is not immediately feasible, implement a 'BeanPostProcessor' to set 'shouldWriteHeadersEagerly' to 'true' for 'HeaderWriterFilter' beans.
• Audit existing codebase for manual 'Content-Length' header settings using the 'io.moderne.recipe.cve202622732.FindSpringSecurityHeaderSuppression' recipe provided by Moderne.