CVE-2011-2731: Spring Security - Concurrent Execution using Shared Resource with Improper Synchronization
Summary
CVE-2011-2731: Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security. Affects org.springframework.security:spring-security-core across 2 version ranges.
< 2.0.7
>= 3.0.0, < 3.0.6
Fixed in 2.0.7 or 3.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is org.springframework.security:spring-security-core, which is a part of the Maven ecosystem. Spring Security is a powerful and highly customizable authentication and access-control framework for Java applications. It provides comprehensive security services for web applications, including authentication, authorization, and protection against common security threats. This vulnerability affects versions before 2.0.7 and 3.0.6 of Spring Security.
Vulnerability Detail
The vulnerability, identified as CVE-2011-2731, is a race condition in the RunAsManager mechanism of Spring Security. It occurs when the Authentication object is stored in the shared security context without proper synchronization. This flaw allows attackers to gain privileges by exploiting a crafted thread. The consequences of this vulnerability can be severe, as it enables unauthorized access and privilege escalation within the application.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.72.0.7 -
>= 3.0.0, < 3.0.63.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by upgrading to the latest secure version of Spring Security.
Conclusion
In conclusion, the CVE-2011-2731 vulnerability in Spring Security exposes applications to privilege escalation attacks. It is crucial to upgrade to the fixed versions (2.0.7 or 3.0.6) of Spring Security to mitigate this risk. Additionally, developers should review their application's security architecture and consider implementing additional security measures. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
Spring Security is a Java framework that provides authentication, authorization, and other security features for web applications.
This vulnerability allows attackers to gain privileges within the application, potentially leading to unauthorized access and privilege escalation.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
Specific exploits for this vulnerability are not mentioned in the provided information. However, it is crucial to address this vulnerability promptly to prevent potential attacks.
You can find more information about this vulnerability, including its technical details and the fixed versions, in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4644-hg35-55m9/GHSA-4644-hg35-55m9.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
