Spring Security Advisories

CVE-2022-22978: Authorization Bypass in RegexRequestMatcher

HIGH | MAY 16, 2022 | CVE-2022-22978


In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers.

Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Affected Spring Products and Versions

  • Spring Security
    • 5.5.x prior to 5.5.7
    • 5.6.x prior to 5.6.4
    • Earlier unsupported versions


Users should update to a version that includes fixes. 5.5.x users should upgrade to 5.5.7 or greater. 5.6.x users should upgrade to 5.6.4 or greater. Releases that have fixed this issue include:

  • Spring Security
    • 5.5.7+
    • 5.6.4+
    • 5.7+


This vulnerability was discovered and responsibly reported by Hiroki Nishino, Toshiki Sasazaki, Yoshinori Hayashi, and Jonghwan Kim from LINE Corporation.


  • 2022-05-16: Initial vulnerability report published.

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Spring Runtime offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all