{"id":"RHLW-2026-6b59708c7adb9eb8","summary":"Lightwell Security Advisory: spring 5.3.18.rhlw-00010","details":"Red Hat Lightwell has released org.springframework:spring 5.3.18.rhlw-00010 with a backported security fix.\n\nCVE-2023-20860: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using \"**\" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.\n\nThis patched artifact is a drop-in replacement for org.springframework:spring 5.3.18 from Maven Central.","modified":"2026-10-22T00:08:34.528319791Z","published":"2026-10-12T16:59:43Z","upstream":["CVE-2023-20860","GHSA-7phw-cxx7-q9vq"],"references":[{"type":"WEB","url":"https://spring.io/security/cve-2023-20860"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/20xxx/CVE-2023-20860.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20860"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7phw-cxx7-q9vq"}],"affected":[{"package":{"name":"org.springframework:spring","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.springframework/spring"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.18.rhlw-00010"}]}],"versions":["1.0","1.0-m4","1.0-rc1","1.0.1","1.1","1.1-rc1","1.1-rc2","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2-rc1","1.2-rc2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","2.0","2.0-m1","2.0-m2","2.0-m3","2.0-m4","2.0-m5","2.0-rc1","2.0-rc2","2.0-rc3","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.6.SEC01","2.5.6.SEC02","2.5.6.SEC03","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.16.RELEASE","5.2.17.RELEASE","5.2.18.RELEASE","5.2.19.RELEASE","5.2.2.RELEASE","5.2.20.RELEASE","5.2.21.RELEASE","5.2.22.RELEASE","5.2.23.RELEASE","5.2.24.RELEASE","5.2.25.RELEASE","5.2.3.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE","5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.15","5.3.16","5.3.17","5.3.18","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"],"database_specific":{"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-6b59708c7adb9eb8.json","lightwell":{"remediated_version":"5.3.18.rhlw-00010","repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"5.3.18"}}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}