CVE-2026-59276

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59276", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-07-04T18:13:09.973Z", "datePublished": "2026-08-27T17:57:34.993Z", "dateUpdated": "2026-08-28T14:00:41.248Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-27T17:57:34.993Z"}, "title": "Timing Attack via Non-Constant-Time Comparison of Sensitive Values", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-208 Observable Timing Discrepancy", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value."}]}], "affected": [{"vendor": "Spring", "product": "Spring Security", "versions": [{"status": "affected", "version": "7.1.0", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThanOrEqual": "7.0.6", "versionType": "custom"}, {"status": "affected", "version": "6.5.0", "lessThanOrEqual": "6.5.11", "versionType": "custom"}, {"status": "affected", "version": "6.4.0", "lessThanOrEqual": "6.4.18", "versionType": "custom"}, {"status": "affected", "version": "5.8.0", "lessThanOrEqual": "5.8.27", "versionType": "custom"}, {"status": "affected", "version": "5.7.0", "lessThanOrEqual": "5.7.25", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.</p><p>Spring Security 7.1.0<br/>Spring Security 7.0.0 - 7.0.6<br/>Spring Security 6.5.0 - 6.5.11<br/>Spring Security 6.4.0 - 6.4.18<br/>Spring Security 5.8.0 - 5.8.27<br/>Spring Security 5.7.0 - 5.7.25</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-59276"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-208", "lang": "en", "description": "CWE-208 Observable Timing Discrepancy"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-28T13:59:17.786904Z", "id": "CVE-2026-59276", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T14:00:41.248Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59276", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-28T13:59:17.786904Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T14:00:37.984Z"}}], "cna": {"title": "Timing Attack via Non-Constant-Time Comparison of Sensitive Values", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Spring Security", "versions": [{"status": "affected", "version": "7.1.0", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "versionType": "custom", "lessThanOrEqual": "7.0.6"}, {"status": "affected", "version": "6.5.0", "versionType": "custom", "lessThanOrEqual": "6.5.11"}, {"status": "affected", "version": "6.4.0", "versionType": "custom", "lessThanOrEqual": "6.4.18"}, {"status": "affected", "version": "5.8.0", "versionType": "custom", "lessThanOrEqual": "5.8.27"}, {"status": "affected", "version": "5.7.0", "versionType": "custom", "lessThanOrEqual": "5.7.25"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-59276"}], "descriptions": [{"lang": "en", "value": "Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25", "supportingMedia": [{"type": "text/html", "value": "<p>Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.</p><p>Spring Security 7.1.0<br/>Spring Security 7.0.0 - 7.0.6<br/>Spring Security 6.5.0 - 6.5.11<br/>Spring Security 6.4.0 - 6.4.18<br/>Spring Security 5.8.0 - 5.8.27<br/>Spring Security 5.7.0 - 5.7.25</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-208 Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-27T17:57:34.993Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59276", "state": "PUBLISHED", "dateUpdated": "2026-08-28T14:00:41.248Z", "dateReserved": "2026-07-04T18:13:09.973Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-08-27T17:57:34.993Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Spring Security", "vendor": "Spring", "versions": [{"status": "affected", "version": "7.1.0", "versionType": "custom"}, {"lessThanOrEqual": "7.0.6", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThanOrEqual": "6.5.11", "status": "affected", "version": "6.5.0", "versionType": "custom"}, {"lessThanOrEqual": "6.4.18", "status": "affected", "version": "6.4.0", "versionType": "custom"}, {"lessThanOrEqual": "5.8.27", "status": "affected", "version": "5.8.0", "versionType": "custom"}, {"lessThanOrEqual": "5.7.25", "status": "affected", "version": "5.7.0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E861D3B-F22C-4CA8-830A-0926FD42EEB3", "versionEndExcluding": "5.7.26", "versionStartIncluding": "5.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "E0BB6ED3-A736-413C-88CE-F5FB8195DA7F", "versionEndExcluding": "5.8.28", "versionStartIncluding": "5.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "087C4F36-7F24-45E6-BDE4-0E3915217C38", "versionEndExcluding": "6.4.19", "versionStartIncluding": "6.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7F694AF-F153-4011-80B4-95C68FD9815C", "versionEndExcluding": "6.5.12", "versionStartIncluding": "6.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD15AD30-A708-4484-B0E2-601254C7341E", "versionEndExcluding": "7.0.6.1", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABC35A3B-2FE4-4ACC-AD66-F1EE62086E08", "versionEndExcluding": "7.1.0.1", "versionStartIncluding": "7.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25"}], "id": "CVE-2026-59276", "lastModified": "2026-09-02T16:45:37.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59276", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-28T13:59:17.786904Z", "version": "2.0.3"}}]}, "published": "2026-08-27T20:17:53.863", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2026-59276"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "org.springframework.security/spring-security-core: Spring Security: Information disclosure via timing attack in sensitive value comparison", "id": "2525258", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525258"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-208", "details": ["Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25", "Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. An attacker capable of submitting a very large number of guesses and precisely measuring response latency could, in principle, use these timing differences to recover the expected value one character at a time.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25"], "mitigation": {"lang": "en:us", "value": "There is no workaround for this issue. Customers should upgrade to a fixed version of the affected Red Hat product when an update becomes available. Upstream fixed versions vary by Spring Security release line (5.7.x through 7.1.x); see the Spring Security advisory at https://spring.io/security/cve-2026-59276 for details."}, "name": "CVE-2026-59276", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Out of support scope", "package_name": "jenkins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Out of support scope", "package_name": "ocp-tools-4/jenkins-rhel8", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Out of support scope", "package_name": "ocp-tools-4/jenkins-rhel9", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "spring-security-core", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Out of support scope", "package_name": "spring-security-core", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-08-27T17:57:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59276\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59276\nhttps://spring.io/security/cve-2026-59276"], "statement": "A flaw was found in Spring Security. Several components compare security-sensitive values using standard string equality rather than constant-time comparison. Because rejection time can correlate with how many leading characters match, an attacker who can submit a very large number of requests and precisely measure response latency could, in theory, recover protected values incrementally, leading to information disclosure. Practical exploitation is difficult due to network variability and the volume of measurements required. Red Hat products that ship an affected version of Spring Security are affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.0.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.5.0,6.5.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.4.0,6.4.18]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.8.0,5.8.27]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.7.0,5.7.25]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Spring Security", "source": "cna", "vendor": "Spring"}, "product": "spring_security", "vendor": "spring"}], "created": "2026-08-28T06:45:04.036592+00:00", "updated": "2026-08-28T18:15:06.339600+00:00", "vendors": ["spring", "spring$PRODUCT$spring_security"]}