CVE-2026-22732: 
Java vulnerability analysis and mitigation

CVE-2026-22732 is a security feature bypass vulnerability in Spring Security servlet applications where HTTP response headers may silently fail to be written under certain conditions when using the default lazy header writing mode. Disclosed on March 19, 2026, it affects Spring Security versions 5.7.0–5.7.21, 5.8.0–5.8.23, 6.3.0–6.3.14, 6.4.0–6.4.14, 6.5.0–6.5.8, and 7.0.0–7.0.3; older unsupported versions may also be affected. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (Spring Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-425 (Direct Request / Forced Browsing) and CWE-166 (Improper Handling of Missing Special Element). The vulnerability lies in Spring Security's HeaderWriterFilter, which by default uses lazy (deferred) header writing — headers are only committed to the HTTP response at the end of the filter chain. Under certain conditions (e.g., when application-level cache headers are set), this lazy mechanism causes Spring Security's security headers to be omitted entirely from the response, rather than merged or overridden. An unauthenticated remote attacker with no privileges or user interaction required can trigger this condition by sending crafted requests that cause the header writing logic to be skipped, effectively stripping protective HTTP headers from responses. A workaround involves setting HeaderWriterFilter.shouldWriteHeadersEagerly to true, though this changes application behavior regarding header precedence (Spring Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated network attacker to bypass security headers configured by the application — such as Content-Security-Policy, X-Frame-Options, Cache-Control, and Strict-Transport-Security — leaving responses without these protections. This can enable downstream attacks including cross-site scripting (XSS), clickjacking, sensitive data exposure via caching mechanisms, and other client-side attacks that the missing headers were designed to prevent. The CVSS score reflects high confidentiality and integrity impact with no availability impact, as the vulnerability does not directly cause data destruction or service disruption but can facilitate significant data exposure and application compromise (Spring Advisory, Feedly).

1. Reconnaissance: Identify web applications using Spring Security servlet mode (not reactive/WebFlux) within the affected version ranges (5.7.0–5.7.21, 5.8.0–5.8.23, 6.3.0–6.3.14, 6.4.0–6.4.14, 6.5.0–6.5.8, 7.0.0–7.0.3). Tools like Shodan, Censys, or application fingerprinting can help identify Spring-based applications.
2. Trigger the header omission condition: Send HTTP requests that cause the application to set its own cache-related or custom response headers before Spring Security's HeaderWriterFilter commits headers. This can occur when application code writes headers early in the response lifecycle.
3. Verify missing security headers: Inspect HTTP responses for the absence of expected security headers (e.g., X-Content-Type-Options, X-Frame-Options, Cache-Control: no-cache, no-store, Content-Security-Policy). Tools like curl -I or browser developer tools can confirm header omission.
4. Exploit the weakened security posture: With protective headers absent, launch secondary attacks such as XSS (if CSP is missing), clickjacking (if X-Frame-Options is absent), or cache poisoning/sensitive data retrieval via caching proxies (if Cache-Control headers are missing) (Spring Advisory).

• Network: HTTP responses from Spring Security-protected endpoints that are missing expected security headers such as X-Frame-Options, X-Content-Type-Options, Cache-Control: no-cache, no-store, Pragma: no-cache, or Content-Security-Policy.
• Logs: Application logs showing no errors or warnings despite security headers not appearing in responses; absence of header-writing log entries from HeaderWriterFilter in Spring Security debug logs.
• Application Behavior: Cached sensitive responses returned by CDN or proxy layers that should have been marked no-store; browser-based XSS or clickjacking attempts succeeding against pages that should have been protected by CSP or framing headers.
• Scanner Findings: Qualys or similar vulnerability scanner alerts referencing CVE-2026-22732 detection IDs (6634973, 6634848, 6634887, 6634863, 6635749) on affected Spring Security deployments (Feedly).

Upgrade Spring Security to the following fixed versions: 5.7.22+ (Enterprise Support only), 5.8.24+ (Enterprise Support only), 6.3.15+ (Enterprise Support only), 6.4.15+ (Enterprise Support only), 6.5.9+ (OSS), or 7.0.4+ (OSS). As an immediate workaround without upgrading, set HeaderWriterFilter.shouldWriteHeadersEagerly to true via an ObjectPostProcessor in Java-based configuration or a custom BeanPostProcessor in XML-based configuration — note this changes header precedence behavior. Additionally, organizations unable to patch immediately should consider enforcing security headers at the reverse proxy or WAF layer to compensate for the missing application-level headers (Spring Advisory). Downstream products from IBM (DevOps Test Performance, DevOps Solution Workbench, Operational Decision Manager, IBM Controller, Library Support for Spring), Atlassian, Splunk AppDynamics, and SAP have also released or are releasing patches addressing this dependency (IBM Advisory, Splunk Advisory, Atlassian Advisory).

The Spring team (Broadcom/VMware) published the official advisory on March 19, 2026, crediting researcher "Wyfrel" for responsible disclosure (Spring Advisory). The Belgian Centre for Cybersecurity (CCB) issued a warning urging immediate patching, characterizing the issue as enabling multiple types of client-side attacks (CCB Advisory). HeroDevs published multiple blog posts covering the vulnerability in depth, including developer guidance for checking exposure and a March 2026 Spring CVE roundup noting a surge of 30 Spring vulnerabilities in two months (HeroDevs Blog). Security media including SecurityOnline.info and Heise covered the vulnerability, and community discussion appeared on Reddit's r/java with developers noting confusion about security headers disappearing with no errors — a symptom directly related to this CVE.