Spring Security (< 5.5.7, 5.6.4)

An authorization bypass vulnerability in Spring Security allows unauthenticated attackers to access restricted endpoints by injecting URL-encoded newline or carriage return characters into request paths protected by RegexRequestMatcher.