CVE-2026-59276: Timing Attack via Non-Constant-Time Comparison of Sensitive Values
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
Affected Software
Event History
Frequently Asked Questions
Which Spring Security versions are affected?
Affected versions are Spring Security 7.1.0; 7.0.0 through 7.0.6; 6.5.0 through 6.5.11; 6.4.0 through 6.4.18; 5.8.0 through 5.8.27; and 5.7.0 through 5.7.25.
What does an attacker need to exploit this issue?
The issue is remotely reachable without privileges or user interaction, but exploitation has high attack complexity. An attacker would need to make comparisons against a sensitive value and reliably measure timing differences that reveal how many leading characters matched.
What is the potential impact if exploitation succeeds?
Successful exploitation may disclose sensitive values through timing differences. The provided assessment indicates high confidentiality impact, with no integrity or availability impact.