CVE-2023-20860: Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-27 · updated 2026-06-17

Description

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Affected products

Spring Framework: from 5.3.0 before 5.3.26; from 6.0.0 before 6.0.7 — fixed in 5.3.26, 6.0.7
Maven Org.Springframework:Spring: from 6.0.0 before 6.0.7; from 5.3.0 before 5.3.26; 5.3.0, 5.3.1, 5.3.10, 5.3.11, 5.3.12, 5.3.13 (+20) — fixed in 6.0.7, 5.3.26
Maven Org.Springframework:Spring-Webmvc: from 6.0.0 before 6.0.7; from 5.3.0 before 5.3.26; 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5 (+27) — fixed in 6.0.7, 5.3.26
Spring Framework: from Spring Framework (versions 6.0.0 through 6.0.6 and 5.3.0 to 5.3.25)

How to fix

Upgrade to a fixed version: Spring Framework 5.3.26, 6.0.7; Maven Org.Springframework:Spring 6.0.7, 5.3.26; Maven Org.Springframework:Spring-Webmvc 6.0.7, 5.3.26. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-20860 or the next vulnerability affects your stack