Executive brief
Spring Security uses standard string comparison instead of constant-time comparison for security-sensitive values, allowing attackers to determine correct values through timing analysis. This affects authentication and token validation components across multiple versions, potentially enabling attackers to forge or crack security credentials by observing response times.
Technical details
Multiple Spring Security components use String.equals() instead of a constant-time comparison function to verify security-sensitive values. The vulnerability allows attackers to exploit timing side-channels: String.equals() returns immediately upon finding the first mismatched character, making the comparison time proportional to the number of correct leading characters. This timing information can be used to systematically guess correct values (e.g., CSRF tokens, authentication strings) without triggering normal authentication failures. The issue affects Spring Security versions 5.7.0–5.8.27, 6.4.0–6.5.11, and 7.0.0–7.1.0.
Affected products
- VMware Spring Security 5.7.0–5.8.27, 6.4.0–6.5.11, 7.0.0–7.1.0
Timeline
- 2026-08-27: disclosed