Vulnerability in Spring Security Affects User Authentication via Malformed X.509 Certificates
CVE-2026-47838

6.8MEDIUM

Key Information:

Vendor

Spring

Status
Spring Security
Vendor
CVE Published:
9 June 2026

What is CVE-2026-47838?

The SubjectDnX509PrincipalExtractor in Spring Security processes X.509 certificate CN values improperly, which may allow an attacker to exploit malformed certificates. This can result in an incorrect username being read, facilitating user impersonation. Proper validation measures are essential to ensure that only valid certificates are accepted, thereby maintaining the integrity of the user authentication process.

Affected Version(s)

Spring Security 5.7.0 < 5.7.25

Spring Security 5.8.0 < 5.8.27

Spring Security 6.3.0 < 6.3.18

References

https://spring.io/security/cve-2026-47838

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.