{"schemaVersion":3,"id":"CVE-2026-22751","aliases":["CGA-2mc5-94mq-j548","CGA-3g2g-47rp-c64j","CGA-57xg-57fr-6765","CGA-64hw-2v8v-jcv6","CGA-6xj4-pf2r-x57h","CGA-76xw-xw5f-55jr","CGA-83rr-95rh-g8hv","CGA-9v2p-2527-72pg","CGA-c42g-c636-g32v","CGA-g4pf-4v47-h93j","CGA-hq6m-vf97-qwhp","CGA-jj89-mwvr-3xwc","CGA-p7m5-gcjp-jw6c","CGA-q2c6-fh3x-836x","CGA-q547-3vpc-79r3","CGA-r439-39cr-wc6c","CGA-r457-28j9-p87m","CGA-wqv6-5j39-8vp5","CGA-wrf6-r6jx-9xjj","CGA-x6q7-h3jg-8g9c","CGA-2vv5-wf3p-q7q4","CGA-335m-wv5j-6pw6","CGA-3p6q-px43-94mm","CGA-42hj-2g5c-h2jx","CGA-4x9j-74v6-2rcw","CGA-582w-qmcq-8443","CGA-5p72-4qw7-xmmv","CGA-5pjr-gqj4-6rhh","CGA-639j-5899-7c3h","CGA-6jv6-gmjf-46ph","CGA-74qm-fvr2-846h","CGA-77xg-4h4p-36hc","CGA-8rjm-76ph-rj47","CGA-8w8p-r6j7-8pmp","CGA-9fq4-v6qc-hpfv","CGA-9rf7-qjp9-ppqq","CGA-cr4w-xv64-wv5m","CGA-g367-fh4w-93hx","CGA-ghq5-hwgp-2wf5","CGA-h9jr-jmmc-qq6x","CGA-j3jc-xqmq-xc6h","CGA-j5gr-6j6c-j9f8","CGA-p5h9-ffpm-3w88","CGA-pff3-hmqv-83x6","CGA-pgc9-p6x8-wvgx","CGA-prfg-w4gg-rf9p","GHSA-x2wq-9x2f-fhj7","CGA-rxfr-7qc7-58hh","CGA-x734-p4r5-r32h","CGA-xfwr-58w4-6p6r","CGA-xmc4-7ggf-f8r2"],"status":"published","duplicateOf":null,"title":null,"description":"Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","dates":{"published":"2026-04-21T18:30:35.428Z","modified":"2026-04-21T18:44:34.841Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.8,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":4.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":5.6,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":4.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":5.6,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":4.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":5.6,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00124,"percentile":0.01957,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.00124},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00124,"percentile":0.01957}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00124,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00124,"percentile":0.01957}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition","description":"The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/367.html"}],"affected":[{"vendor":"chainguard","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi","purlType":"apk","versions":[{"text":"< 2.9.0-r3","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r3 | < 2.9.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.9.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-registry-toolkit","name":"apache-nifi-registry-toolkit","label":"apache-nifi-registry-toolkit","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-registry-toolkit","purlType":"apk","versions":[{"text":"< 2.9.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-8.8","name":"camunda-8.8","label":"camunda-8.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-8.8","purlType":"apk","versions":[{"text":"< 8.8.24-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.8.24-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-8.9","name":"camunda-8.9","label":"camunda-8.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-8.9","purlType":"apk","versions":[{"text":"< 8.9.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.9.2-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.6","name":"camunda-zeebe-8.6","label":"camunda-zeebe-8.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.7","name":"camunda-zeebe-8.7","label":"camunda-zeebe-8.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.7","purlType":"apk","versions":[{"text":"< 8.7.29-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.7.29-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.8","name":"camunda-zeebe-8.8","label":"camunda-zeebe-8.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.8","purlType":"apk","versions":[{"text":"< 8.8.24-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.8.24-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.9","name":"camunda-zeebe-8.9","label":"camunda-zeebe-8.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.9","purlType":"apk","versions":[{"text":"< 8.9.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.9.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.555.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-25","name":"jenkins-2-openjdk-25","label":"jenkins-2-openjdk-25","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-25","purlType":"apk","versions":[{"text":"< 2.555.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.528-openjdk-17","name":"jenkins-2.528-openjdk-17","label":"jenkins-2.528-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.528-openjdk-17","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.528-openjdk-21","name":"jenkins-2.528-openjdk-21","label":"jenkins-2.528-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.528-openjdk-21","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541","name":"jenkins-2.541","label":"jenkins-2.541","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541","purlType":"apk","versions":[{"text":"< 2.541.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541-openjdk-17","name":"jenkins-2.541-openjdk-17","label":"jenkins-2.541-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541-openjdk-17","purlType":"apk","versions":[{"text":"< 2.541.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541-openjdk-21","name":"jenkins-2.541-openjdk-21","label":"jenkins-2.541-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541-openjdk-21","purlType":"apk","versions":[{"text":"< 2.541.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui","name":"kafbat-ui","label":"kafbat-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui","purlType":"apk","versions":[{"text":"< 1.4.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui-fips","name":"kafbat-ui-fips","label":"kafbat-ui-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui-fips","purlType":"apk","versions":[{"text":"< 1.4.2-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos","name":"nacos","label":"nacos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos","purlType":"apk","versions":[{"text":"< 3.2.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos-docker","name":"nacos-docker","label":"nacos-docker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos-docker","purlType":"apk","versions":[{"text":"< 3.2.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi","purlType":"apk","versions":[{"text":"< 2.9.0-r3","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r3 | < 2.9.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.9.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-registry-toolkit","name":"apache-nifi-registry-toolkit","label":"apache-nifi-registry-toolkit","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-registry-toolkit","purlType":"apk","versions":[{"text":"< 2.9.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.555.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-25","name":"jenkins-2-openjdk-25","label":"jenkins-2-openjdk-25","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-25","purlType":"apk","versions":[{"text":"< 2.555.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r11","eol":null,"hubHref":null},{"vendor":"org.springframework.security","product":"spring-security-core","name":"org.springframework.security:spring-security-core","label":"spring-security-core","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework.security/spring-security-core","purlType":"maven","versions":[{"text":"≥ 6.5.0, < 6.5.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.3, < 7.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, ≤ 6.4.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.5.0, < 6.5.10 | ≥ 7.0.3, < 7.0.5 | ≥ 6.4.0, ≤ 6.4.13","eol":{"isEol":null,"eolDate":null,"matchMethod":"purl","cycle":null,"product":{"name":"spring-security","label":"Spring Security","category":"framework"}},"hubHref":null},{"vendor":"spring","product":"spring security","name":"Spring Security","label":"spring security","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.4.0, ≤ 6.4.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, ≤ 6.5.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.4.0, ≤ 6.4.15 | ≥ 6.5.0, ≤ 6.5.9 | ≥ 7.0.0, ≤ 7.0.4","eol":null,"hubHref":"/vendor/spring/spring_security"},{"vendor":"vmware","product":"spring_security","name":"spring security","label":"spring_security","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.4.0, < 6.4.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, < 6.5.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.4.0, < 6.4.16 | ≥ 6.5.0, < 6.5.10 | ≥ 7.0.0, < 7.0.5","eol":null,"hubHref":"/vendor/vmware/spring_security"}],"affectedCount":30,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://spring.io/security/cve-2026-22751","label":"spring.io/security/cve-2026-22751","hostname":"spring.io","tags":["WEB","Vendor Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22751.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22751.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22751","label":"nvd.nist.gov/vuln/detail/CVE-2026-22751","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047","label":"github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-security/commit/4187af38b251fc97fdf9949f7869618111e6e261","label":"github.com/spring-projects/spring-security/commit/4187af38b251fc97fdf9949f7869618111e6e261","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-security","label":"github.com/spring-projects/spring-security","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://jinyeong.seol.pro/blogs/cve-2026-22751/en","label":"jinyeong.seol.pro/blogs/cve-2026-22751/en","hostname":"jinyeong.seol.pro","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-CFXF-WW8Q-22PX"]},"timeline":[{"kind":"published","date":"2026-04-21T18:30:35.428Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-21T18:44:34.841Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":19,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T13:55:38.088Z","stale":false,"partial":false}}