cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
Spring Security's DPoPProofJwtDecoderFactory uses an internal cache to store the processed jti (JWT ID) claims, which is intended to protect against replay attacks by ensuring that each DPoP proof is only used once. However, this cache has a strict maximum size limit of entries. If the attacker is able to intercept a legitimate user's valid DPoP proof, they can flood the server with dummy requests to forcefully evict the legitimate jti from the cache. Once the jti is evicted, the attacker can successfully replay the intercepted valid DPoP proof, leading to unauthorized access and impersonatio…
Spring Security Advisories에서 읽기
| CVE | CVE-2026-41707 |
|---|---|
| 정보원 | Spring Security Advisories |
| 수집 시각 | 2026. 10. 22. 오전 01:17 |
| 데이터 | Markdown JSON |
2026. 08. 20. 오전 09:00, Spring Security Advisories에서 "cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Spring, Java. CVE: CVE-2026-41707.