Medium [CVE-2026-59276] org.springframework.security/spring-security-core: Spring Security: Information disclosure via timing attack in sensitive value comparison

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison.

Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.

An attacker capable of submitting a very large number of guesses and precisely measuring response latency could, in principle, use these timing differences to recover the expected value one character at a time.

Because rejection time can correlate with how many leading characters match, an attacker who can submit a very large number of requests and precisely measure response latency could, in theory, recover protected values incrementally, leading to information disclosure.

Practical exploitation is difficult due to network variability and the volume of measurements required. Red Hat products that ship an affected version of Spring Security are affected.

Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-208.

Affected Red Hat products: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat OpenShift Dev Spaces; Red Hat Single Sign-On 7. Will not fix / out of support: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat Single Sign-On 7.