Skip to content
fr Sign in
6.8 Medium

CVE-2026-22747 Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509…

Description

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

Affected products and versions

Product Affected versions Fixed in
Spring Security 7.0 7.0.0 → 7.0.4 No fix stated
OpenShift Developer Tools and Services Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Show the 4 other branches
Product Affected versions Fixed in
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Single Sign-On 7 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Security

The 29 CVEs of Spring Security →
CVE-2026-59277 Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing… 3.7 Low CVE-2026-59276 Several components in Spring Security compare security-sensitive values using standard string equality (String.equals())… 5.9 Medium CVE-2026-59270 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative… 9.4 Critical CVE-2026-47877 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding 8.2 High
Track this CVE