Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Spring Security SAML2 component updated to prevent possible attack
published 1 month ago
Summary
The Spring Security SAML2 service‑provider library contained a security weakness that could be exploited by attackers. TuxCare has released a rebuilt version (6.2.2‑tuxcare.7) that corrects the issue. Apply this update as soon as possible to keep your applications safe.
What to do
- Update springframework org.springframework.security:spring-security-acl to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-aspects to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-bom to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-cas to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-config to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-core to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-crypto to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-data to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-ldap to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-messaging to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-oauth2-client to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-oauth2-core to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-oauth2-jose to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-oauth2-resource-server to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-rsocket to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-saml2-service-provider to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-taglibs to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-test to version 6.2.2-tuxcare.7.
- Update springframework org.springframework.security:spring-security-web to version 6.2.2-tuxcare.7.
- Update org.springframework.security:spring-security-saml2-service-provider to version 6.2.2-tuxcare.7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-acl |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-aspects |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-bom |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-cas |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-config |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-core |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-crypto |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-data |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-ldap |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-messaging |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-oauth2-client |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-oauth2-core |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-oauth2-jose |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-oauth2-resource-server |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-rsocket |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-saml2-service-provider |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-taglibs |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-test |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | springframework | org.springframework.security:spring-security-web |
< 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
| TuxCare:Maven | – | org.springframework.security:spring-security-saml2-service-provider |
>= 6.2.2, < 6.2.2-tuxcare.7 Fix: upgrade to 6.2.2-tuxcare.7
|
Original advisory text
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 1 CVE. Fixed in 6.2.2-tuxcare.7.
Timeline
Published5 Oct 2026
Updated30 Oct 2026
First seen5 Oct 2026
Sources
CLSA-2026-1791188726 · OSV
Track software like this
Free during beta