Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-22751

Fixed in a distro release EPSS <1%CVSS 4.8

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Published 2026-04-21 · CVE record · OSV

Products: Spring Security

Fixed upstream

EcosystemPackageFixed in
Mavenorg.springframework.security:spring-security-core6.5.10
Mavenorg.springframework.security:spring-security-core7.0.5
Mavenorg.springframework.security:spring-security-coreno fix

Distro releases

ReleasePackageFixed in
Chainguardapache-nifi2.9.0-r0
Chainguardapache-nifi2.9.0-r3
Chainguardapache-nifi-registry2.9.0-r4
Chainguardapache-nifi-registry-toolkit2.9.0-r4
Chainguardcamunda-8.88.8.24-r0
Chainguardcamunda-8.98.9.2-r0
Chainguardcamunda-zeebe-8.68.6.40-r0
Chainguardcamunda-zeebe-8.78.7.29-r0
Chainguardcamunda-zeebe-8.88.8.24-r0
Chainguardcamunda-zeebe-8.98.9.5-r0
Chainguardjenkins-2-openjdk-212.555.1-r1
Chainguardjenkins-2-openjdk-252.555.1-r1
Chainguardjenkins-2.528-openjdk-17no fix
Chainguardjenkins-2.528-openjdk-21no fix
Chainguardjenkins-2.5412.541.3-r3
Chainguardjenkins-2.541-openjdk-172.541.3-r3
Chainguardjenkins-2.541-openjdk-212.541.3-r3
Chainguardkafbat-ui1.4.2-r9
Chainguardkafbat-ui-fips1.4.2-r8
Chainguardnacos3.2.1-r2
Chainguardnacos-docker3.2.1-r1
Chainguardthingsboard-tb-node4.3.1.1-r11
Wolfiapache-nifi2.9.0-r0
Wolfiapache-nifi2.9.0-r3
Wolfiapache-nifi-registry2.9.0-r4
Wolfiapache-nifi-registry-toolkit2.9.0-r4
Wolfijenkins-2-openjdk-212.555.1-r1
Wolfijenkins-2-openjdk-252.555.1-r1
Wolfithingsboard-tb-node4.3.1.1-r11