Update dependency org.springframework.security:spring-security-web to v7.0.6 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.springframework.security:spring-security-web (source)	7.0.5 → 7.0.6

---

Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache

CVE-2026-41706 / GHSA-x2r2-rvhq-2mqv

More information

Details

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target.

Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-41706
• https://spring.io/security/cve-2026-41706
• https://github.com/spring-projects/spring-security/releases/tag/6.5.11
• https://github.com/spring-projects/spring-security/releases/tag/7.0.6
• https://github.com/advisories/GHSA-x2r2-rvhq-2mqv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

spring-projects/spring-security (org.springframework.security:spring-security-web)

v7.0.6

Compare Source

🪲 Bug Fixes

• FormPostRedirectStrategy should not emit percent-encoded values into hidden form inputs #​19137
• AbstractAuthenticationFilterConfigurer should not automatically pick up servlet path #​19128
• Principal Extractor should select the left-most RDN attribute value #​19254

🔨 Dependency Upgrades

• Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs #​19184
• Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.34 #​19266
• Bump com.webauthn4j:webauthn4j-core from 0.31.3.RELEASE to 0.31.5.RELEASE #​19151
• Bump com.webauthn4j:webauthn4j-core from 0.31.5.RELEASE to 0.31.6.RELEASE #​19265
• Bump gradle-wrapper from 8.14.4 to 8.14.5 #​19160
• Bump io-micrometer from 1.16.5 to 1.16.6 #​19292
• Bump io.mockk:mockk from 1.14.9 to 1.14.11 #​19247
• Bump io.projectreactor:reactor-bom from 2025.0.5 to 2025.0.6 #​19298
• Bump org-bouncycastle from 1.80 to 1.80.2 #​19193
• Bump org.apache.maven:maven-resolver-provider from 3.9.15 to 3.9.16 #​19192
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 #​19174
• Bump org.springframework.data:spring-data-bom from 2025.1.5 to 2025.1.6 #​19294
• Bump org.springframework.ldap:spring-ldap-core from 4.0.3 to 4.0.4 #​19289
• Bump org.springframework:spring-framework-bom from 7.0.7 to 7.0.8 #​19288
• Bump spring-io/spring-release-actions from 0.0.4 to 0.0.5 #​19182
• Update to Micrometer 1.16.5 #​19225

🔩 Build Updates

• Release 7.0.6 #​19239

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.