The Silent Leak: Critical 9.1 CVSS Spring Security Flaw Strips Away Vital HTTP Headers

A critical-severity vulnerability (CVE-2026-22732, CVSS 9.1) in Spring Security can cause security HTTP response headers (e.g., Cache-Control, Pragma, X-Content-Type-Options) to be omitted in certain servlet application configurations, risking sensitive data exposure via caching and increasing susceptibility to XSS, clickjacking, and related web attacks; multiple active release branches are affected and the Spring team has released patches—organizations should upgrade to fixed versions promptly.