Spring Boot vulnerabilities

3 known vulnerabilities in Spring Boot from VMware. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Spring Security: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-22733Mar 20, 2026Spring

  Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Sec

• 7.5 High severity

  Apache Shiro: Interpretation Conflict

  CVE-2023-22602Jan 14, 2023ApacheEPSS 1.66%

  When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro a

• 7.8 High severity

  Spring Boot: Exposure of Resource to Wrong Sphere

  CVE-2022-27772Mar 30, 2022VMware

  spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only