CVE-2026-59276

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Spring Security versions 5.8.0 through 5.8.27 Spring Security versions 5.7.0 through 5.7.25

Description Several components use standard string equality via the String.equals() function to compare security-sensitive values instead of using a constant-time comparison. This allows the time taken to reject an incorrect value to be proportional to the number of leading characters that match the expected value, potentially enabling timing attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.