Spring Security Authorization Bypass for Case Sensitive Comparisons
Priority LOW 22CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 11 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-639.
Summary
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Partial org.springframework.security:spring-security-core (Maven): 5.7.14, 5.8.16, 6.0.14 +3Red Hat: 11 advisoriesRed Hat: 11 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Spring by VMware Tanzu | Spring Security | 5.7.0 - 5.7.13, 5.8.0 - 5.8.15, 6.0.0 - 6.0.13, 6.1.0 - 6.1.11, 6.2.0 - 6.2.7, 6.3.0 - 6.3.4, Older unsupported versions are also affected | — | No fix listed | CNA |
| — | org.springframework.security:spring-security-core (Maven) | before 5.7.14 | 5.7.14 | Patch available | GHSA-q3v6-hm2v-pw99 |
| — | org.springframework.security:spring-security-core (Maven) | 5.8.0 to before 5.8.16 | 5.8.16 | Patch available | GHSA-q3v6-hm2v-pw99 |
| — | org.springframework.security:spring-security-core (Maven) | 6.0.0 to before 6.0.14 | 6.0.14 | Patch available | GHSA-q3v6-hm2v-pw99 |
| — | org.springframework.security:spring-security-core (Maven) | 6.1.0 to before 6.1.12 | 6.1.12 | Patch available | GHSA-q3v6-hm2v-pw99 |
| — | org.springframework.security:spring-security-core (Maven) | 6.2.0 to before 6.2.8 | 6.2.8 | Patch available | GHSA-q3v6-hm2v-pw99 |
| — | org.springframework.security:spring-security-core (Maven) | 6.3.0 to before 6.3.5 | 6.3.5 | Patch available | GHSA-q3v6-hm2v-pw99 |
- Spring Security VendorSpring by VMware Tanzu Affected 5.7.0 - 5.7.13, 5.8.0 - 5.8.15, 6.0.0 - 6.0.13, 6.1.0 - 6.1.11, 6.2.0 - 6.2.7, 6.3.0 - 6.3.4, Older unsupported versions are also affected Fixed in — No fix listed CNA
- org.springframework.security:spring-security-core (Maven) Vendor— Affected before 5.7.14 Fixed in 5.7.14 Patch available GHSA-q3v6-hm2v-pw99
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.8.0 to before 5.8.16 Fixed in 5.8.16 Patch available GHSA-q3v6-hm2v-pw99
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 6.0.0 to before 6.0.14 Fixed in 6.0.14 Patch available GHSA-q3v6-hm2v-pw99
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 6.1.0 to before 6.1.12 Fixed in 6.1.12 Patch available GHSA-q3v6-hm2v-pw99
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 6.2.0 to before 6.2.8 Fixed in 6.2.8 Patch available GHSA-q3v6-hm2v-pw99
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 6.3.0 to before 6.3.5 Fixed in 6.3.5 Patch available GHSA-q3v6-hm2v-pw99
Remediation
- Fix · GHSA-q3v6-hm2v-pw99 org.springframework.security:spring-security-core (Maven) Fixed in 5.7.14 Advisory →
- Fix · GHSA-q3v6-hm2v-pw99 org.springframework.security:spring-security-core (Maven) Fixed in 5.8.16 Advisory →
- Fix · GHSA-q3v6-hm2v-pw99 org.springframework.security:spring-security-core (Maven) Fixed in 6.0.14 Advisory →
- Fix · GHSA-q3v6-hm2v-pw99 org.springframework.security:spring-security-core (Maven) Fixed in 6.1.12 Advisory →
- Fix · GHSA-q3v6-hm2v-pw99 org.springframework.security:spring-security-core (Maven) Fixed in 6.2.8 Advisory →
- Fix · GHSA-q3v6-hm2v-pw99 org.springframework.security:spring-security-core (Maven) Fixed in 6.3.5 Advisory →
Red Hat 11 advisories
- RHSA-2026:88159 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88158 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88157 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 8 more Red Hat advisories
- RHSA-2026:88156 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88155 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88154 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88153 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88151 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88152 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88149 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88150 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| OpenShift Developer Tools and Services 4.12 | Fixed | RHSA-2026:88152 |
| OpenShift Developer Tools and Services 4.13 | Fixed | RHSA-2026:88149 |
| OpenShift Developer Tools and Services 4.14 | Fixed | RHSA-2026:88151 |
| OpenShift Developer Tools and Services 4.15 | Fixed | RHSA-2026:88150 |
| OpenShift Developer Tools and Services 4.16 | Fixed | RHSA-2026:88156 |
| OpenShift Developer Tools and Services 4.17 | Fixed | RHSA-2026:88159 |
| OpenShift Developer Tools and Services 4.18 | Fixed | RHSA-2026:88153 |
| OpenShift Developer Tools and Services 4.19 | Fixed | RHSA-2026:88158 |
| OpenShift Developer Tools and Services 4.20 | Fixed | RHSA-2026:88157 |
| OpenShift Developer Tools and Services 4.21 | Fixed | RHSA-2026:88155 |
| OpenShift Developer Tools and Services 4.22 | Fixed | RHSA-2026:88154 |
Not affected: 22 products
- A-MQ Clients 2
- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21
- OpenShift Developer Tools and Services 4.22
- Red Hat Build of Keycloak
- Red Hat Integration Camel K 1
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel for Spring Boot 4
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2024-38827
- 2026-10-03 Alias added: GHSA-q3v6-hm2v-pw99
- 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
- 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
References
Other 6
- https://spring.io/security/cve-2024-38827
- https://github.com/spring-projects/spring-framework/issues/33708
- https://github.com/spring-projects/spring-framework/issues/34232
- https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9
- https://github.com/spring-projects/spring-security
- https://security.netapp.com/advisory/ntap-20250124-0007
More Spring by VMware Tanzu vulnerabilities
- TI-2024-14851 Arbitrary File Write Vulnerability in Spring Cloud Data Flow CVSS 3.1HIGH 8.8
- TI-2024-14858 Spring Cloud Function Web DOS Vulnerability CVSS 3.1HIGH 8.2
Sources
- CVE-2024-38827 · CVE Program
- CVE-2024-38827 · NVD
- FIRST EPSS
- GHSA-q3v6-hm2v-pw99 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-38827 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences