cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality ( String.equals() ) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. An attacker capable of submitting a very large number of guesses and precisely measuring response latency could, in principle, use these timing differences to recover the expected value one character at a time. The affected comparison…

Spring Security Advisoriesで読む

2026/08/20 09:00、Spring Security Advisoriesが「cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values」を公開しました (種別: 脆弱性アドバイザリ)。関連する技術: Spring、Java。CVE: CVE-2026-59276。