https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T13:37:22.736486+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/ghsa-293q-567p-wmwq GHSA-293q-567p-wmwq — Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates 2026-10-01T13:37:22.760324+00:00

Affected: Maven: org.springframework.security:spring-security-web

In Spring Security Web, `SubjectDnX509PrincipalExtractor` does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

`SubjectDnX509PrincipalExtractor` is deprecated by this CVE and replaced with `SubjectX500PrincipalExtractor`. As part of updating, you should also migrate to `SubjectX500PrincipalExtractor`.

Affected versions: Spring Security Enterprise 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. OSS 6.5.0 through 6.5.10.