Spring Security Timing Attack: String.equals() non-constant comparison v67
CVE-2026-59276 Published on August 27, 2026
Timing Attack via Non-Constant-Time Comparison of Sensitive Values
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
Vulnerability Analysis
CVE-2026-59276 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.
Products Associated with CVE-2026-59276
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Security:- Version 7.1.0 is affected.
- Version 7.0.0, <= 7.0.6 is affected.
- Version 6.5.0, <= 6.5.11 is affected.
- Version 6.4.0, <= 6.4.18 is affected.
- Version 5.8.0, <= 5.8.27 is affected.
- Version 5.7.0, <= 5.7.25 is affected.