Spring security advisory (AV26-259)

[MalBot]

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

  <div>
<div>

        <div><p><strong>Serial number: </strong>AV26-259<br /><strong>Date: </strong>March 19, 2026</p>

On March 19, 2026, Spring published security advisories to address vulnerabilities in the following products. Included was a critical update for the following:

• Spring Boot – multiple versions
• Spring Security – multiple versions

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• CVE-2026-22731: Authentication Bypass under Actuator Health groups paths
• CVE-2026-22718: Under Some Conditions Spring Security HTTP Headers Are not Written
• CVE-2026-22733: Authentication Bypass under Actuator CloudFoundry endpoints
• Spring Security Advisories

</div>

Article Link: Spring security advisory (AV26-259) - Canadian Centre for Cyber Security