CVE-2023-20860: VMware Spring Framework

High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days.

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Affected products

• VMware Spring Framework: from 5.3.0, before 5.3.26 (fixed in 5.3.26); from 6.0.0, before 6.0.7 (fixed in 6.0.7)

Published 2023-03-27. Last modified 2026-06-17.