{"schemaVersion":3,"id":"CVE-2026-22732","aliases":["CGA-5f22-5fm2-7f9g","CGA-5fq2-93hv-crjv","CGA-63hj-49ch-5cph","CGA-7f88-7j59-924c","CGA-9fhq-5wfx-w8m3","CGA-9mj6-8925-6h2p","CGA-hxr9-v6gh-vm96","CGA-p3v4-84m6-5pmq","CGA-q38f-422j-hv9j","CGA-qhgm-g5mw-6v8x","CGA-qx6v-92gp-j4q7","CGA-vv47-r3gc-whf9","CGA-22gq-xwp2-mvg5","CGA-254x-6j7c-8h9h","CGA-2cfj-893x-86hq","CGA-2xfx-3hmm-267f","CGA-3799-gp33-mp95","CGA-3mhm-m9jx-4q9q","CGA-3qw3-w7m3-g3cj","CGA-4888-5f27-gwp7","CGA-48jh-29jx-fc37","CGA-4mh9-wgc4-46h7","CGA-56c3-cmgq-mmjq","CGA-5jv2-jvrp-pgv9","CGA-5rmm-hq97-v9cg","CGA-63q6-52x3-2cv5","CGA-68hh-w9r4-f4cp","CGA-6m8r-73j7-9vg8","CGA-6p4m-v3fv-5qw5","CGA-77wx-8437-2hcg","CGA-7r53-5282-c546","CGA-838g-4wpc-265p","CGA-8fr7-92gg-29gq","CGA-8r5j-w7h7-pj38","CGA-9fq5-rvj7-v486","CGA-9r86-ch84-5526","CGA-c7hx-fpgw-r29r","CGA-cgqc-jrgx-jh64","CGA-cr6x-7q27-j2jc","CGA-cv5j-m67g-82mw","CGA-g36h-6p8v-5fc7","CGA-gfgh-9rc6-qjgw","CGA-gfp5-cvw5-3f7g","CGA-ghv2-7w4r-rcfc","CGA-grx9-mr48-228r","CGA-h27p-w4hj-37mh","CGA-h3cr-95c3-688c","CGA-hpcx-xp4p-9q58","CGA-hr83-8vcv-jmcc","CGA-m322-c8v9-8jjw","CGA-m4f5-c937-cvp7","CGA-m752-f9fq-43q2","CGA-m8h3-xmgv-8jvf","CGA-mqf3-xq77-8r55","CGA-mrmp-v28g-hj9j","CGA-mxw5-93vm-6j89","GHSA-mf92-479x-3373","CGA-pwj9-wr8q-pqq6","CGA-q242-8c6q-9ffx","CGA-q6r2-q6fm-7hx3","CGA-q73x-4j82-jfpv","CGA-qfq8-994m-6wg3","CGA-qpvj-hv22-v6qc","CGA-r345-hxfv-r875","CGA-r3c4-q4mr-45rp","CGA-r5qp-xcjg-2v79","CGA-r62h-fpcf-6g4j","CGA-rcv9-6q32-f8c5","CGA-rmh8-7pjr-4g8x","CGA-wjmj-5r4w-rjcg","CGA-wwj6-w27h-q6vm","CGA-x8fc-qgjr-vrqh","CGA-xr9c-h9v6-7pf3"],"status":"published","duplicateOf":null,"title":null,"description":"When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.\nThis issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:\n\n: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.","dates":{"published":"2026-03-19T22:47:38.199Z","modified":"2026-04-02T07:20:58.779Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.1,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":10,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":10,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":10,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00489,"percentile":0.40704,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0.009000000000000067,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.0048},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00489,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00489,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00489,"percentile":0.40704}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0048,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00489,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00489,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00489,"percentile":0.40704}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_137F9CC56E8B637C","name":"Exploit Reference (spring.io)","source":"reference","url":"https://spring.io/security/cve-2026-22732","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-425","name":"Direct Request ('Forced Browsing')","description":"The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/425.html"}],"affected":[{"vendor":"chainguard","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi","purlType":"apk","versions":[{"text":"< 2.8.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.8.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.8.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.8.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-registry-toolkit","name":"apache-nifi-registry-toolkit","label":"apache-nifi-registry-toolkit","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-registry-toolkit","purlType":"apk","versions":[{"text":"< 2.8.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.8.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-8.8","name":"camunda-8.8","label":"camunda-8.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-8.8","purlType":"apk","versions":[{"text":"< 8.8.22-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.8.22-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.6","name":"camunda-zeebe-8.6","label":"camunda-zeebe-8.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.6","purlType":"apk","versions":[{"text":"< 8.6.39-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.6.39-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.7","name":"camunda-zeebe-8.7","label":"camunda-zeebe-8.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.7","purlType":"apk","versions":[{"text":"< 8.7.27-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.7.27-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.8","name":"camunda-zeebe-8.8","label":"camunda-zeebe-8.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.8","purlType":"apk","versions":[{"text":"< 8.8.22-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.8.22-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"geoserver-2.27","name":"geoserver-2.27","label":"geoserver-2.27","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/geoserver-2.27","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"geoserver-2.28","name":"geoserver-2.28","label":"geoserver-2.28","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/geoserver-2.28","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.555-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-25","name":"jenkins-2-openjdk-25","label":"jenkins-2-openjdk-25","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-25","purlType":"apk","versions":[{"text":"< 2.555-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.516-openjdk-17","name":"jenkins-2.516-openjdk-17","label":"jenkins-2.516-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.516-openjdk-17","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.516-openjdk-21","name":"jenkins-2.516-openjdk-21","label":"jenkins-2.516-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.516-openjdk-21","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.528-openjdk-17","name":"jenkins-2.528-openjdk-17","label":"jenkins-2.528-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.528-openjdk-17","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.528-openjdk-21","name":"jenkins-2.528-openjdk-21","label":"jenkins-2.528-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.528-openjdk-21","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541","name":"jenkins-2.541","label":"jenkins-2.541","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541","purlType":"apk","versions":[{"text":"< 2.541.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541-openjdk-17","name":"jenkins-2.541-openjdk-17","label":"jenkins-2.541-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541-openjdk-17","purlType":"apk","versions":[{"text":"< 2.541.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541-openjdk-21","name":"jenkins-2.541-openjdk-21","label":"jenkins-2.541-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541-openjdk-21","purlType":"apk","versions":[{"text":"< 2.541.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui","name":"kafbat-ui","label":"kafbat-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui","purlType":"apk","versions":[{"text":"< 1.4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui-fips","name":"kafbat-ui-fips","label":"kafbat-ui-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui-fips","purlType":"apk","versions":[{"text":"< 1.4.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.0","name":"kayenta-2025.0","label":"kayenta-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.1","name":"kayenta-2025.1","label":"kayenta-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.2","name":"kayenta-2025.2","label":"kayenta-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.4","name":"kayenta-2025.4","label":"kayenta-2025.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2026.0","name":"kayenta-2026.0","label":"kayenta-2026.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2026.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2026.1","name":"kayenta-2026.1","label":"kayenta-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2026.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.0","name":"kayenta-fips-2025.0","label":"kayenta-fips-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.1","name":"kayenta-fips-2025.1","label":"kayenta-fips-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.2","name":"kayenta-fips-2025.2","label":"kayenta-fips-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.4","name":"kayenta-fips-2025.4","label":"kayenta-fips-2025.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2026.0","name":"kayenta-fips-2026.0","label":"kayenta-fips-2026.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2026.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2026.1","name":"kayenta-fips-2026.1","label":"kayenta-fips-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2026.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos","name":"nacos","label":"nacos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos","purlType":"apk","versions":[{"text":"< 3.2.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos-docker","name":"nacos-docker","label":"nacos-docker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos-docker","purlType":"apk","versions":[{"text":"< 3.2.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ranger","name":"ranger","label":"ranger","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ranger","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi","purlType":"apk","versions":[{"text":"< 2.8.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.8.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.8.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.8.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-registry-toolkit","name":"apache-nifi-registry-toolkit","label":"apache-nifi-registry-toolkit","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-registry-toolkit","purlType":"apk","versions":[{"text":"< 2.8.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.8.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.555-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-25","name":"jenkins-2-openjdk-25","label":"jenkins-2-openjdk-25","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-25","purlType":"apk","versions":[{"text":"< 2.555-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r0","eol":null,"hubHref":null},{"vendor":"org.springframework.security","product":"spring-security-web","name":"org.springframework.security:spring-security-web","label":"spring-security-web","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework.security/spring-security-web","purlType":"maven","versions":[{"text":"≤ 5.7.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.8.0, ≤ 5.8.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, ≤ 6.3.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, ≤ 6.4.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, < 6.5.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.7.14 | ≥ 5.8.0, ≤ 5.8.16 | ≥ 6.0.0, ≤ 6.3.10 | ≥ 6.4.0, ≤ 6.4.13 | ≥ 6.5.0, < 6.5.9 | ≥ 7.0.0, < 7.0.4","eol":{"isEol":null,"eolDate":null,"matchMethod":"purl","cycle":null,"product":{"name":"spring-security","label":"Spring Security","category":"framework"}},"hubHref":null},{"vendor":"vmware","product":"spring_security","name":"spring security","label":"spring_security","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.7.0, ≤ 5.7.21","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.8.0, ≤ 5.8.23","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.3.0, ≤ 6.3.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, ≤ 6.4.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, ≤ 6.5.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.3","noFixRecorded":false,"fixedIn":null},{"text":"< 5.7.22","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.8.0, < 5.8.24","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.3.0, < 6.3.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, < 6.4.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, < 6.5.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.7.0, ≤ 5.7.21 | ≥ 5.8.0, ≤ 5.8.23 | ≥ 6.3.0, ≤ 6.3.14 | ≥ 6.4.0, ≤ 6.4.14 | ≥ 6.5.0, ≤ 6.5.8 | ≥ 7.0.0, ≤ 7.0.3 | < 5.7.22 | ≥ 5.8.0, < 5.8.24 | ≥ 6.3.0, < 6.3.15 | ≥ 6.4.0, < 6.4.15 | ≥ 6.5.0, < 6.5.9 | ≥ 7.0.0, < 7.0.4","eol":null,"hubHref":"/vendor/vmware/spring_security"}],"affectedCount":44,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://spring.io/security/cve-2026-22732","label":"spring.io/security/cve-2026-22732","hostname":"spring.io","tags":["WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22732.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22732.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22732","label":"nvd.nist.gov/vuln/detail/CVE-2026-22732","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/spring-projects/spring-security","label":"github.com/spring-projects/spring-security","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-J87J-7FW6-JFQX"]},"timeline":[{"kind":"published","date":"2026-03-19T22:47:38.199Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-02T07:20:58.779Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:21:24.459Z","stale":false,"partial":false}}