CVE-2023-34034

A flaw was found in Spring Security’s WebFlux framework pattern matching, where it does not properly evaluate certain patterns. A server using path-based pattern matching in WebFlux could allow an attacker to bypass security settings for some request paths, potentially leading to information disclosure, access of functionality outside the user’s permissions, or denial of service.

Mitigation

Users of path-based URL determination should ensure that all their patterns have a slash prepended.
example:
pathMatchers("home/") // vulnerable
pathMatchers("/home/") // not vulnerable