fix(security): mitigate CVE-2026-22732 — Spring Security HTTP headers not written#41669
fix(security): mitigate CVE-2026-22732 — Spring Security HTTP headers not written#41669
Conversation
…5.12 Upgrade Spring Boot from 3.5.11 to 3.5.12, which bundles Spring Security 6.5.9 (patched) and Spring Framework 6.2.17. Pin Lombok to 1.18.42 to avoid a breaking change in 1.18.44 that makes @FieldNameConstants inner class constructors private.
WalkthroughSpring Boot parent BOM updated from 3.5.11 to 3.5.12. A new Maven property Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
app/server/pom.xml (1)
33-34: Add a tracked issue reference to the Lombok version pin.The pin is valid—there are 67+
@FieldNameConstantsusages across 30+ Java files using the innerFieldsclass pattern that triggers the breaking change in 1.18.44. However, without an explicit issue tracker (e.g.,TEMP(APP-XXXX)), this constraint may silently block future Lombok upgrades. Consider updating the comment to reference a ticket and document the migration surface required to remove it.♻️ Suggested tweak
- <!-- Pin Lombok to 1.18.42 to avoid breaking `@FieldNameConstants` inner class constructor change in 1.18.44 --> + <!-- TEMP(APP-XXXX): Pin Lombok to 1.18.42 due `@FieldNameConstants` constructor behavior in 1.18.44. + Remove after migrating affected patterns, then return to Spring Boot managed version. --> <lombok.version>1.18.42</lombok.version>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@app/server/pom.xml` around lines 33 - 34, Update the inline comment that pins lombok.version (the <lombok.version> property) to include a tracked issue ID (e.g., TEMP(APP-XXXX)) and a short summary of the migration surface (mention the 67+ usages of `@FieldNameConstants` and the inner Fields class change) so future upgraders know why the pin exists and what must be addressed to remove it; reference the <lombok.version> property and the `@FieldNameConstants/Fields` pattern in the comment and link to the ticket for detailed migration steps.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@app/server/pom.xml`:
- Around line 33-34: Update the inline comment that pins lombok.version (the
<lombok.version> property) to include a tracked issue ID (e.g., TEMP(APP-XXXX))
and a short summary of the migration surface (mention the 67+ usages of
`@FieldNameConstants` and the inner Fields class change) so future upgraders know
why the pin exists and what must be addressed to remove it; reference the
<lombok.version> property and the `@FieldNameConstants/Fields` pattern in the
comment and link to the ticket for detailed migration steps.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f9a23d79-4049-4b98-9fd3-1b8bffa1c412
📒 Files selected for processing (1)
app/server/pom.xml
|
Proof that the CVE has been resolved: I created a DP in the shadow EE PR, and the Docker Scout results confirm the fix. Previously, there were three CRITICAL CVEs; this has now been reduced to two. 
|
1 participant
Description
TL;DR: Upgrades Spring Boot from 3.5.11 to 3.5.12 to mitigate CVE-2026-22732 (CVSS 9.1 — Critical), a vulnerability where Spring Security HTTP response headers may not be written under certain conditions.
What is CVE-2026-22732?
Under some conditions, Spring Security fails to write HTTP response headers (such as
Cache-Control,Pragma,X-Content-Type-Options) for servlet applications. This can expose applications to:Affected versions: Spring Security 6.5.0 – 6.5.8
Fix version: Spring Security 6.5.9
Advisory: https://spring.io/security/cve-2026-22732
Why upgrade Spring Boot instead of just overriding
spring-security.version?Two approaches were evaluated:
spring-security.versionto 6.5.9We chose Option B because:
Lombok pin
Spring Boot 3.5.12 bumps Lombok from 1.18.42 to 1.18.44. Lombok 1.18.44 introduced a breaking change where
@FieldNameConstantsgenerates innerFieldsclasses with private constructors, which broke the project's pattern of subclassingBaseDomain.Fieldsacross 13 domain classes. The fix pins Lombok back to 1.18.42 via<lombok.version>1.18.42</lombok.version>— the same pattern already used in the project for Jackson and SnakeYAML overrides.Applicability note
While the CVE advisory specifically states "servlet applications" and Appsmith uses WebFlux (reactive), the vulnerable
spring-security-webjar is on the classpath. Upgrading is prudent for compliance, defense-in-depth, and because the reactive header-writing code shares internals with the servlet path.Changes
app/server/pom.xml: Bumpspring-boot-starter-parentfrom3.5.11→3.5.12app/server/pom.xml: Pin<lombok.version>1.18.42</lombok.version>to avoid@FieldNameConstantsbreakageVerification
./build.sh -DskipTests -T 8, 31 modules)Fixes https://spring.io/security/cve-2026-22732
Fixes https://linear.app/appsmith/issue/APP-15061/critical-cve-2026-22732-spring-security-http-headers-not-written
Automation
/ok-to-test tags="@tag.All"
🔍 Cypress test results
Tip
🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/23677516478
Commit: e2bec36
Cypress dashboard.
Tags:
@tag.AllSpec:
Sat, 28 Mar 2026 09:31:55 UTC
Communication
Should the DevRel and Marketing teams inform users about this change?
Summary by CodeRabbit