Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 2 vendors · 2 advisories

CVE-2026-59276

CVE-2026-59276: 2 tracked advisory records across Red Hat, VMware. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium5.9

    Medium [CVE-2026-59276] org.springframework.security/spring-security-core: Spring Security: Information disclosure via timing attack in sensitive value comparison

    CVE-2026-59276Source published Source updated

    Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. An attacker capable of submitting a very large number of guesses and precisely measuring response latency could, in principle, use these timing differences to recover the expected value one character at a time. Because rejection time can correlate with how many leading characters match, an attacker who can submit a very large number of requests and precisely measure response latency could, in theory, recover protected values…

    Affected products in this advisory
    • OpenShift Developer Tools and Services
    • Red Hat Fuse 7
    • Red Hat OpenShift Dev Spaces
    • Red Hat Single Sign-On 7
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • There is no workaround for this issue. Customers should upgrade to a fixed version of the affected Red Hat product when an update becomes available. Upstream fixed versions vary by Spring Security release line (5.7.x through 7.1.x); see the Spring Security advisory at https://spring.io/security/cve-2026-59276 for details.
    Full advisory and evidenceOpen source bulletin

VMware

1 advisory
  • Advisory severityMedium5.9

    Medium [CVE-2026-59276] Spring Security: Several components in Spring Security compare security-sensitive values using standard string equality (String.equals…

    CVE-2026-59276Source published Source updated

    Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.

    Affected products in this advisory
    • Spring Security
    Source-reported affected versions
    • Spring Security 7.1.0
    • Spring Security 7.0.0 through 7.0.6
    • Spring Security 6.5.0 through 6.5.11
    • Spring Security 6.4.0 through 6.4.18

    2 more entries in the full advisory.

    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features