CVE-2026-59276

Analyzed Analyzed - Analysis Complete

Timing Attack in Spring Security

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59276

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_security	From 6.5.0 (inc) to 6.5.12 (exc)
vmware	spring_security	From 6.4.0 (inc) to 6.4.19 (exc)
vmware	spring_security	From 5.7.0 (inc) to 5.7.26 (exc)
vmware	spring_security	From 5.8.0 (inc) to 5.8.28 (exc)
vmware	spring_security	From 7.1.0 (inc) to 7.1.0.1 (exc)
vmware	spring_security	From 7.0.0 (inc) to 7.0.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This is a timing attack vulnerability where Spring Security components compare sensitive values like passwords or tokens using standard string equality checks instead of constant-time methods. This allows attackers to measure response times to guess secrets by observing timing differences when values are rejected.

Detection Guidance

Detecting this vulnerability requires monitoring for timing discrepancies in authentication responses. Use network tools like Wireshark to capture and analyze response times for DigestAuthenticationFilter, KeyBasedPersistenceTokenService, or password encoder endpoints. Look for variations in response times when submitting incorrect credentials or tokens.

Impact Analysis

An attacker could exploit this to recover secrets such as passwords, authentication digests, or tokens by sending many requests and measuring response times. This could lead to impersonation or unauthorized access to systems using affected Spring Security versions.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling timing attacks that recover sensitive authentication data like passwords or tokens. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A successful exploit could lead to unauthorized access, violating confidentiality requirements in both standards.

Mitigation Strategies

Upgrade to the latest fixed versions of Spring Security immediately: 5.7.26, 5.8.28, 6.4.19, 6.5.12, 7.0.7, or 7.1.1. If upgrading is not possible, disable affected components like DigestAuthenticationFilter or use alternative implementations with constant-time comparison methods.

Hi! I’m here to help you understand CVE-2026-59276. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70