grails

How are you all updating grails 6 to handle the CVE - For <https://spring.io/security/cve-2026-22732>

I'm guessing the "actual" bug fix is this: <https://github.com/spring-projects/spring-security/pull/18798>

I'm not sure if the Grails Spring Security implementation is even using that class.  I would need to dig fruther to know though.

So yeah, based on the credit they gave, this is related: <https://github.com/spring-projects/spring-framework/issues/36381>

Which specifically  calls out the headers - we don't use the headers() directive in the Spring security configuration for Grails

I'm not saying we aren't  vulnerable, but initial look indicates we aren't based on the code in that issue

I just compared the release versions for OSS and looked for the same change in both btw.  I'm assuming any documented change would be in the release notes (it may just be a commit)