Spring Security Advisories

RSS feed

Unauthorized User Impersonation when Using X.509 Client Certificates

MEDIUM | JUNE 09, 2026 | CVE-2026-47838

Description

This CVE is a continuation of CVE-2026-22747, which addressed this same issue for Spring Security 7.0.x.

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

Environmental Considerations

This component sits behind Spring Security's pre-authentication flow, which assumes the presented credentials have already been validated by a trusted upstream. Exploiting this issue therefore presupposes a compromise of that upstream trust. So while we recommend upgrading, this fix is better understood as defense-in-depth than as closing a standalone attack path.

Affected Spring Products and Versions

Spring Security:

  • 6.5.0 - 6.5.10
  • 6.4.0 - 6.4.17
  • 6.3.0 - 6.3.17
  • 5.8.0 - 5.8.26
  • 5.7.24 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
6.5.11OSS
6.5.10.2Enterprise Support Only
6.4.18Enterprise Support Only
6.3.18Enterprise Support Only
5.8.27Enterprise Support Only
5.7.25Enterprise Support Only

SubjectDnX509PrincipalExtractor is deprecated by this CVE and replaced with SubjectX500PrincipalExtractor. As part of updating, you should also migrate to SubjectX500PrincipalExtractor.

Credit

The issue was identified and responsibly reported by Nikita Markevich.

References

History

  • 2026-06-09: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all