Overview
About vulnerability
This CVE is a continuation of [CVE-2026-22747](https://spring.io/security/cve-2026-22747), which addressed this same issue for Spring Security 7.0.x.
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
[SVG Image](#environmental-considerations)Environmental Considerations
This component sits behind Spring Security’s pre-authentication flow, which assumes the presented credentials have already been validated by a trusted upstream. Exploiting this issue therefore presupposes a compromise of that upstream trust. So while we recommend upgrading, this fix is better understood as defense-in-depth than as closing a standalone attack path.
Details
- Affected product:
- Apache CXF , Apache Log4j , Spring , camel , grails-core
- Affected packages:
- Spring Integration @ 5.5.19 (+4282 more)