Spring security advisory (AV26-259)

Serial number: AV26-259
Date: March 19, 2026

On March 19, 2026, Spring published security advisories to address vulnerabilities in the following products. Included was a critical update for the following:

• Spring Boot – multiple versions
• Spring Security – multiple versions

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• CVE-2026-22731: Authentication Bypass under Actuator Health groups paths
• CVE-2026-22718: Under Some Conditions Spring Security HTTP Headers Are not Written
• CVE-2026-22733: Authentication Bypass under Actuator CloudFoundry endpoints
• Spring Security Advisories