Skip to main content

Find unconditional WebFlux response commit calls (CVE-2026-22732)

io.moderne.recipe.cve202622732.FindHttpResponseContentLengthOrFlushBuffer

Detects WebFlux calls that commit a `ServerHttpResponse` outside the lazy header-writing path: `writeWith(..)`, `writeAndFlushWith(..)`, `setComplete()`, and `HttpHeaders.setContentLength(long)`. Under CVE-2026-22732 these patterns cause Spring Security's lazy-added security headers to be dropped. The sibling recipe `FindHttpResponseContentLengthHeader` covers the servlet `setHeader` / `setIntHeader` / `addIntHeader` case. In addition to marking Java sinks, attaches a {@code SearchResult} marker to every source file in the affected project so this recipe can be used as a declarative precondition for build-level recipes.

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Used by​

This recipe is used as part of the following composite recipes:

Usage​

This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI.

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe FindHttpResponseContentLengthOrFlushBuffer

If the recipe is not available locally, then you can install it using:

mod config recipes jar install io.moderne.recipe:rewrite-cve-2026-22732:0.3.0

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

WebFlux response direct-commit findings​

io.moderne.recipe.cve202622732.table.HttpResponseDirectCommitTable

Rows for ServerHttpResponse / HttpHeaders calls that commit a WebFlux response outside the lazy header-writing path (writeWith, writeAndFlushWith, setComplete, HttpHeaders.setContentLength).

Column NameDescription
Source fileThe source file the finding is in.
LineThe line number of the invocation.
Enclosing classThe fully-qualified enclosing class name, if available.
Enclosing methodThe enclosing method name, if available.
KindOne of WEBFLUX_WRITE_WITH, WEBFLUX_WRITE_AND_FLUSH_WITH, WEBFLUX_SET_COMPLETE, HTTP_HEADERS_SET_CONTENT_LENGTH.
InvocationThe source text of the flagged invocation.