{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/header-manipulation/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-22732"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Spring Security (\u003c 5.7.22, 5.8.24, 6.3.15, 6.4.15, 6.5.9, 7.0.4)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","web-application","spring-security","header-manipulation"],"_cs_type":"advisory","_cs_vendors":["Vmware"],"content_html":"\u003cp\u003eCVE-2026-22732 is a vulnerability in Spring Security where specific methods for setting the 'Content-Length' header bypass the 'OnCommittedResponseWrapper'. This prevents the wrapper from triggering 'onResponseCommitted()', causing the framework to fail to inject essential security headers such as 'X-Frame-Options', 'X-Content-Type-Options', and 'Cache-Control'. This vulnerability affects multiple versions of Spring Security. Fixes are available in versions 6.5.9 and 7.0.4; for versions where an upgrade is not possible, a 'BeanPostProcessor' configuration can be applied to force eager header writing.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the suppression of critical security headers. This exposes applications to various web-based attacks that rely on the absence of browser-side security policies, such as clickjacking (due to missing 'X-Frame-Options') or MIME-sniffing attacks (due to missing 'X-Content-Type-Options').\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Spring Security to the patched versions: 6.5.9 or 7.0.4.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, implement a 'BeanPostProcessor' to set 'shouldWriteHeadersEagerly' to 'true' for 'HeaderWriterFilter' beans.\u003c/li\u003e\n\u003cli\u003eAudit existing codebase for manual 'Content-Length' header settings using the 'io.moderne.recipe.cve202622732.FindSpringSecurityHeaderSuppression' recipe provided by Moderne.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T00:26:18Z","date_published":"2026-10-30T00:26:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-spring-security-header-bypass/","summary":"A vulnerability in Spring Security versions \u003c 7.0.4 allows attackers to bypass security header injection by manipulating the Content-Length header, leading to the absence of X-Frame-Options and other security headers.","title":"VMware Spring Security Content-Length header suppression (CVE-2026-22732)","url":"https://feed.craftedsignal.io/briefs/2026-10-spring-security-header-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Header-Manipulation","version":"https://jsonfeed.org/version/1.1"}