CVE-2019-3795: Insecure Randomness Vulnerability in Spring Security
Summary
CVE-2019-3795: Spring Security uses insufficiently random values. Affects org.springframework.security:spring-security-core across 3 version ranges.
>= 4.2.0, < 4.2.12
>= 5.0.0, < 5.0.12
>= 5.1.0, < 5.1.5
Fixed in 4.2.12, 5.0.12 or 5.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Security package is a widely used security framework for Java applications. It provides authentication and authorization functionalities to secure web applications. The package includes various modules, with the core module being 'spring-security-core'. This vulnerability affects versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 of the 'spring-security-core' module.
Vulnerability Detail
The vulnerability arises from the insecure use of randomness in Spring Security. Specifically, when using the 'SecureRandomFactoryBean#setSeed' method to configure a SecureRandom instance, insufficiently random values are generated. This vulnerability can be exploited if an honest application provides a seed and the resulting random material is made available to an attacker for inspection. The impact of this vulnerability can vary depending on the specific usage of the affected application.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.124.2.12 -
>= 5.0.0, < 5.0.125.0.12 -
>= 5.1.0, < 5.1.55.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to a secure version of the 'spring-security-core' module.
Conclusion
The 'spring-security-core' module in Spring Security versions 4.2.x, 5.0.x, and 5.1.x is vulnerable to an insecure randomness issue. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions mentioned above. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
Spring Security is a security framework for Java applications that provides authentication and authorization functionalities.
Versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 of the 'spring-security-core' module are affected.
This vulnerability can be exploited if an application provides a seed and the resulting random material is made available to an attacker for inspection.
The impact of this vulnerability can vary depending on the specific usage of the affected application.
No specific workarounds are mentioned for this vulnerability. It is recommended to upgrade to a secure version of the 'spring-security-core' module.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
