AIKIDO-2026-11165

spring-security-web is vulnerable to Improper Validation of Certificate with Host Mismatch

Improper Validation of Certificate with Host MismatchCVE-2026-47838 Published Yesterday

Medium Risk

This Affects:

spring-security-web

0.0.1 - 5.7.24

Fixed in 5.7.25

5.8.0 - 5.8.26

Fixed in 5.8.27

6.3.0 - 6.3.17

Fixed in 6.3.18

6.4.0 - 6.4.17

Fixed in 6.4.18

6.5.0 - 6.5.10

Fixed in 6.5.11

Are you affected? Scan for Free

TL;DR

This CVE is a continuation of CVE-2026-22747, which addressed this same issue for Spring Security 7.0.x. SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

spring-security-web is vulnerable to Improper Validation of Certificate with Host Mismatch in versions 0.0.1 - 5.7.24, 5.8.0 - 5.8.26, 6.3.0 - 6.3.17, 6.4.0 - 6.4.17 and 6.5.0 - 6.5.10.