Spring Security versions 5.7.x and 5.8.x not impacted by CVE-2026-22748
Article ID: 450372
Updated On:
Products
Issue/Introduction
Security scanners or customer inquiries may flag Spring Security versions 5.7.x or 5.8.x as potentially vulnerable to CVE-2026-22748.
Users have noted that the official advisory focuses on version 6.x and later, leading to questions regarding the availability of patches for the 5.7 and 5.8 branches.
Cause
The vulnerability described in CVE-2026-22748 pertains to specific API functionality that was not introduced into the Spring Security framework until version 6.1.
Resolution
Resolution Spring Security versions 5.7.x and 5.8.x are not affected by this vulnerability.
No Patch Required: Because the vulnerable code path and associated APIs do not exist in these earlier versions, no security patches are necessary or will be released for the 5.7 or 5.8 branches.
Advisory Scope: The official security advisory https://spring.io/security correctly lists impact starting from version 6.0 and later, as these are the versions containing the relevant features.
If you are using Spring Security 6.1.x or later, please refer to the official Spring Security Advisory for the appropriate upgrade path to a patched version (e.g., 6.3.15+).
Feedback
