CVE-2026-47838

HighCVSS 8.1/10Last modified Jul 23, 2026

Description

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Spring	Spring Security	>= 5.7.0, < 5.7.25; >= 5.8.0, < 5.8.27; >= 6.3.0, < 6.3.18; >= 6.4.0, < 6.4.18; >= 6.5.0, < 6.5.10.2

References

https://spring.io/security/cve-2026-47838Vendor Advisory

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-478399.2A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting th CVE-2026-47849.8A vulnerability was found in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /checkcheckout.php of the CVE-2026-478407.5A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, th CVE-2026-478417.4An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session CVE-2026-478426.5Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode en CVE-2026-478433.7In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previousl CVE-2026-478443.7In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the CVE-2026-478455.3In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order f CVE-2026-478469.8Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is config CVE-2026-478475.3Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replicatio CVE-2026-478486.1In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials CVE-2026-478497.1Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/jso