https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T04:24:01.485871+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/ghsa-2jrg-rf5x-568g GHSA-2jrg-rf5x-568g — Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates 2026-10-03T04:24:01.500368+00:00

Affected: Maven: org.springframework.security:spring-security-web

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.