Spring Security (< 5.7.22, 5.8.24, 6.3.15, 6.4.15, 6.5.9, 7.0.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/spring-security--5.7.22-5.8.24-6.3.15-6.4.15-6.5.9-7.0.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 00:26:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVMware Spring Security Content-Length header suppression (CVE-2026-22732)https://feed.craftedsignal.io/briefs/2026-10-spring-security-header-bypass/Fri, 30 Oct 2026 00:26:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-spring-security-header-bypass/A vulnerability in Spring Security versions < 7.0.4 allows attackers to bypass security header injection by manipulating the Content-Length header, leading to the absence of X-Frame-Options and other security headers.CVE-2026-22732 is a vulnerability in Spring Security where specific methods for setting the 'Content-Length' header bypass the 'OnCommittedResponseWrapper'. This prevents the wrapper from triggering 'onResponseCommitted()', causing the framework to fail to inject essential security headers such as 'X-Frame-Options', 'X-Content-Type-Options', and 'Cache-Control'. This vulnerability affects multiple versions of Spring Security. Fixes are available in versions 6.5.9 and 7.0.4; for versions where an upgrade is not possible, a 'BeanPostProcessor' configuration can be applied to force eager header writing.

Impact

Successful exploitation results in the suppression of critical security headers. This exposes applications to various web-based attacks that rely on the absence of browser-side security policies, such as clickjacking (due to missing 'X-Frame-Options') or MIME-sniffing attacks (due to missing 'X-Content-Type-Options').

Recommendation

  • Upgrade Spring Security to the patched versions: 6.5.9 or 7.0.4.
  • If upgrading is not immediately feasible, implement a 'BeanPostProcessor' to set 'shouldWriteHeadersEagerly' to 'true' for 'HeaderWriterFilter' beans.
  • Audit existing codebase for manual 'Content-Length' header settings using the 'io.moderne.recipe.cve202622732.FindSpringSecurityHeaderSuppression' recipe provided by Moderne.
]]>highadvisoryvulnerabilityweb-applicationspring-securityheader-manipulation