Skip to content
Fencer Intel
high 7.5

CVE-2016-9879 json

Security Constraint Bypass in Spring Security

published 2017-01-06 9 y ago modified 2026-06-17 4 mo ago also GHSA-v35c-49j6-q8hq , EUVD-2020-1289

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.

Patch / fix

  • maven org.springframework.security:spring-security-core 3.2.10.RELEASE, 4.1.4.RELEASE, 4.2.1.RELEASE

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-9879 updated cvss 6.5

Security: Improper handling of path parameters allows bypassing the security constraint

  • Red Hat JBoss Fuse 6 camel
    affected: workaround, no fix planned “Use a Servlet container known not to include path parameters in the return values for getServletPath() and getPathInfo()”
  • Red Hat Enterprise Virtualization 3 jasperreports-server-pro Red Hat OpenShift Enterprise 2 spring-security-core
    under investigation
  • Red Hat JBoss A-MQ 6.3 Red Hat JBoss Fuse 6.3
    fixed: vendor fix “Use a Servlet container known not to include path parameters in the return values for getServletPath() and getPathInfo()” RHSA-2017:1832

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework.security:spring-security-core
<3.2.10.RELEASE
>=4.0.0.RELEASE, <4.1.4.RELEASE
>=4.2.0.RELEASE, <4.2.1.RELEASE
3.2.10.RELEASE
4.1.4.RELEASE
4.2.1.RELEASE

Affected products

  • n/a Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1

Classification

Weakness
  • CWE-417 Communication Channel Errors
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.