Vulnerability in Spring Spring Security.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 22, 2026 · NIST NVD

   Detected

   Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

2. Jul 15, 2026 · NIST NVD

   Updated

   Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

Affected

• cpe vmware/spring securityversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-22747

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-22747

  Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonati

  nvd.nist.gov

References

• Reference · access.redhat.com
• Reference · bugzilla.redhat.com
• Reference · security.access.redhat.com
• Vendor Advisory · spring.io