When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When applications specify HTTP response headers for servlet applications using Spring Security, there is
    the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet
    applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through
    5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through
    7.0.3. (CVE-2026-22732)

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16588 advisory.

  - This Security Headers Omission vulnerability allows an unauthenticated attacker to receive responses where     security HTTP headers (such as Cache-Control, X-Frame-Options, and X-Content-Type-Options) are silently     omitted, enabling secondary attacks such as clickjacking, cache poisoning, or MIME-type sniffing, which has     high impact to confidentiality, high impact to integrity, no impact to availability, and requires no user     interaction.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
462940	Echo: org.springframework.security:spring-security-web: security update to 6.2.0+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
462940	Echo: org.springframework.security:spring-security-web: security update to 6.2.0+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
317404	Atlassian Jira Service Management Data Center and Server 10.0.0 < 10.3.7 / 10.4.0 < 11.3.5 (JSDSERVER-16588)	Nessus	Misc.	Local	critical
439103	SCA: security update for org.springframework.security:spring-security-web (GHSA-mf92-479x-3373)	Tenable Cloud Security	SCA Checks	Local	critical
439103	SCA: security update for org.springframework.security:spring-security-web (GHSA-mf92-479x-3373)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-22732

critical

Tenable Plugins

critical

critical

critical

critical

critical