CVE-2026-47838
HIGH WAF: Low
CVSS 8.1
Published: 2026-06-10
CWE-287
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
WAF Coverage Analysis
Improper Authentication
Low WAF Coverage
OWASP: A07:2021 Identification and Authentication Failures
Affected Software
| Vendor | Product | Version |
|---|---|---|
| vmware | spring_security | up to 5.7.25 |
| vmware | spring_security | 5.8.0 - 5.8.27 |
| vmware | spring_security | 6.3.0 - 6.3.18 |
| vmware | spring_security | 6.4.0 - 6.4.18 |
| vmware | spring_security | 6.5.0 - 6.5.11 |
References
- spring.io (Vendor Advisory)