CVE-2026-47838
Unauthorized User Impersonation when Using X.509 Client Certificates
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Unauthorized User Impersonation when Using X.509 Client Certificates
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
- Record
CVE-2026-47838- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2026-35911
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
- Record
EUVD-2026-35911- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-293q-567p-wmwq
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
In Spring Security Web, SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
SubjectDnX509PrincipalExtractor is deprecated by this CVE and replaced with SubjectX500PrincipalExtractor. As part of updating, you should also migrate to SubjectX500PrincipalExtractor.
Affected versions: Spring Security Enterprise 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. OSS 6.5.0 through 6.5.10.
- Record
GHSA-293q-567p-wmwq- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
- Record
CVE-2026-47838- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Unauthorized User Impersonation when Using X.509 Client Certificates
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
- Record
CVE-2026-47838- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-293q-567p-wmwq
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
In Spring Security Web, SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
SubjectDnX509PrincipalExtractor is deprecated by this CVE and replaced with SubjectX500PrincipalExtractor. As part of updating, you should also migrate to SubjectX500PrincipalExtractor.
Affected versions: Spring Security Enterprise 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. OSS 6.5.0 through 6.5.10.
- Record
GHSA-293q-567p-wmwq- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
Show 21 moreShow less
OSVCLSA-2026-1781571272 No score
TuxCare security update for org.springframework.security:spring-security-web (2 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-web to address 2 CVEs. Fixed in 6.4.3-tuxcare.4.
- Record
CLSA-2026-1781571272- Updated
- 2026-11-02
OSVCLSA-2026-1782781163 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 5.8.16-tuxcare.11.
- Record
CLSA-2026-1782781163- Updated
- 2026-11-02
OSVCLSA-2026-1783386141 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.11-tuxcare.4.
- Record
CLSA-2026-1783386141- Updated
- 2026-11-02
OSVCLSA-2026-1783991058 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 6.3.10-tuxcare.10.
- Record
CLSA-2026-1783991058- Updated
- 2026-11-02
OSVCLSA-2026-1784769509 No score
TuxCare security update for org.springframework.security:spring-security-web (2 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-web to address 2 CVEs. Fixed in 6.2.2-tuxcare.3.
- Record
CLSA-2026-1784769509- Updated
- 2026-11-02
OSVCLSA-2026-1785204414 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 6.4.13-tuxcare.1.
- Record
CLSA-2026-1785204414- Updated
- 2026-11-02
OSVCLSA-2026-1785814912 No score
TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.8-tuxcare.1.
- Record
CLSA-2026-1785814912- Updated
- 2026-11-02
OSVCLSA-2026-1785814923 No score
TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.7-tuxcare.1.
- Record
CLSA-2026-1785814923- Updated
- 2026-11-02
OSVCLSA-2026-1785965552 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.14-tuxcare.4.
- Record
CLSA-2026-1785965552- Updated
- 2026-11-02
OSVCLSA-2026-1787661459 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 5.7.12-tuxcare.8.
- Record
CLSA-2026-1787661459- Updated
- 2026-11-02
OSVCLSA-2026-1789583743 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.7.
- Record
CLSA-2026-1789583743- Updated
- 2026-11-02
OSVCLSA-2026-1790159292 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 9 CVEs. Fixed in 6.3.9-tuxcare.1.
- Record
CLSA-2026-1790159292- Updated
- 2026-11-02
OSVCLSA-2026-1792077066 No score
TuxCare security update for org.springframework.security (8 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 8 CVEs. Fixed in 6.0.8-tuxcare.4.
- Record
CLSA-2026-1792077066- Updated
- 2026-11-02
OSVCLSA-2026-1792079446 No score
TuxCare security update for org.springframework.security (15 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.
- Record
CLSA-2026-1792079446- Updated
- 2026-11-02
OSVCLSA-2026-1792079757 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 6.1.6-tuxcare.8.
- Record
CLSA-2026-1792079757- Updated
- 2026-11-02
OSVCLSA-2026-1793727013 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 3.2.8.RELEASE-tuxcare.2.
- Record
CLSA-2026-1793727013- Updated
- 2026-11-04
OSVCLSA-2026-1793728525 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 5.6.10-tuxcare.11.
- Record
CLSA-2026-1793728525- Updated
- 2026-11-04
OSVCLSA-2026-1793729146 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 3 CVEs. Fixed in 5.6.7-tuxcare.3.
- Record
CLSA-2026-1793729146- Updated
- 2026-11-04
OSVCLSA-2026-1793730751 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 5.8.15-tuxcare.4.
- Record
CLSA-2026-1793730751- Updated
- 2026-11-04
OSVCLSA-2026-1793732589 No score
TuxCare security update for org.springframework.security:spring-security-web (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-web to address 1 CVE. Fixed in 5.5.8-tuxcare.3.
- Record
CLSA-2026-1793732589- Updated
- 2026-11-04
OSVROOT-APP-MAVEN-CVE-2026-47838 No score
CVE-2026-47838 in io.root.org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2026-47838 in the io.root.org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-47838- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-webMaven |
6.5.0 to 6.5.10 | 6.5.11 |
org.springframework.security:spring-security-webMaven |
6.4.0 to 6.4.13 | None known |
org.springframework.security:spring-security-webMaven |
6.0.0 to 6.3.10 | None known |
org.springframework.security:spring-security-webMaven |
5.8.0 to 5.8.16 | None known |
org.springframework.security:spring-security-webMaven |
through 5.7.14 | None known |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
6.4.3 up to 6.4.3-tuxcare.4, plus listed versions 6.4.3-tuxcare.16.4.3-tuxcare.26.4.3-tuxcare.3 |
6.4.3-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.8.16 up to 5.8.16-tuxcare.11, plus listed versions 5.8.16-tuxcare.105.8.16-tuxcare.45.8.16-tuxcare.55.8.16-tuxcare.65.8.16-tuxcare.7 Show 6 moreShow less5.8.16-tuxcare.85.8.16-tuxcare.95.8.16.tuxcare5.8.16.tuxcare.15.8.16.tuxcare.25.8.16.tuxcare.3 |
5.8.16-tuxcare.11 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 4 CVEs |
5.7.11 up to 5.7.11-tuxcare.4, plus listed versions 5.7.11-tuxcare.15.7.11-tuxcare.25.7.11-tuxcare.35.7.11.tuxcare |
5.7.11-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 4 CVEs |
5.7.11 up to 5.7.11-tuxcare.4, plus listed versions 5.7.11-tuxcare.15.7.11-tuxcare.25.7.11-tuxcare.35.7.11.tuxcare |
5.7.11-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.3.10 up to 6.3.10-tuxcare.10, plus listed versions 6.3.10-tuxcare.16.3.10-tuxcare.26.3.10-tuxcare.36.3.10-tuxcare.46.3.10-tuxcare.5 Show 4 moreShow less6.3.10-tuxcare.66.3.10-tuxcare.76.3.10-tuxcare.86.3.10-tuxcare.9 |
6.3.10-tuxcare.10 |
Show 44 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
6.2.2 up to 6.2.2-tuxcare.3, plus listed versions 6.2.2-tuxcare.16.2.2-tuxcare.2 |
6.2.2-tuxcare.3 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.4.13 up to 6.4.13-tuxcare.1 | 6.4.13-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 2 CVEs |
6.2.8 up to 6.2.8-tuxcare.1 | 6.2.8-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
6.2.8 up to 6.2.8-tuxcare.1 | 6.2.8-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 2 CVEs |
6.2.7 up to 6.2.7-tuxcare.1 | 6.2.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
6.2.7 up to 6.2.7-tuxcare.1 | 6.2.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 4 CVEs |
5.7.14 up to 5.7.14-tuxcare.4, plus listed versions 5.7.14-tuxcare.15.7.14-tuxcare.25.7.14-tuxcare.3 |
5.7.14-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 4 CVEs |
5.7.14 up to 5.7.14-tuxcare.4, plus listed versions 5.7.14-tuxcare.15.7.14-tuxcare.25.7.14-tuxcare.3 |
5.7.14-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.7.12 up to 5.7.12-tuxcare.8, plus listed versions 5.7.12-tuxcare.15.7.12-tuxcare.25.7.12-tuxcare.35.7.12-tuxcare.45.7.12-tuxcare.55.7.12-tuxcare.65.7.12-tuxcare.7 |
5.7.12-tuxcare.8 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 3 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.7, plus listed versions 4.2.20.RELEASE-tuxcare.14.2.20.RELEASE-tuxcare.24.2.20.RELEASE-tuxcare.34.2.20.RELEASE-tuxcare.44.2.20.RELEASE-tuxcare.54.2.20.RELEASE-tuxcare.6 |
4.2.20.RELEASE-tuxcare.7 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 3 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.7, plus listed versions 4.2.20.RELEASE-tuxcare.14.2.20.RELEASE-tuxcare.24.2.20.RELEASE-tuxcare.34.2.20.RELEASE-tuxcare.44.2.20.RELEASE-tuxcare.54.2.20.RELEASE-tuxcare.6 |
4.2.20.RELEASE-tuxcare.7 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.7, plus listed versions 4.2.20.RELEASE-tuxcare.14.2.20.RELEASE-tuxcare.24.2.20.RELEASE-tuxcare.34.2.20.RELEASE-tuxcare.44.2.20.RELEASE-tuxcare.54.2.20.RELEASE-tuxcare.6 |
4.2.20.RELEASE-tuxcare.7 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 8 CVEs |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 8 CVEs |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 8 CVEs |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 8 CVEs |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 8 CVEs |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 6 CVEs |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 6 CVEs |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 6 CVEs |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-webTuxCare:Maven |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.2, plus listed versions 3.2.8.RELEASE-tuxcare.1 |
3.2.8.RELEASE-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.6.10 up to 5.6.10-tuxcare.11, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.105.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.4 Show 5 moreShow less5.6.10-tuxcare.55.6.10-tuxcare.65.6.10-tuxcare.75.6.10-tuxcare.85.6.10-tuxcare.9 |
5.6.10-tuxcare.11 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.6.7 up to 5.6.7-tuxcare.3, plus listed versions 5.6.7-tuxcare.15.6.7-tuxcare.2 |
5.6.7-tuxcare.3 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
5.6.7 up to 5.6.7-tuxcare.3, plus listed versions 5.6.7-tuxcare.15.6.7-tuxcare.2 |
5.6.7-tuxcare.3 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.8.15 up to 5.8.15-tuxcare.4, plus listed versions 5.8.15-tuxcare.25.8.15-tuxcare.35.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.5.8 up to 5.5.8-tuxcare.3, plus listed versions 5.5.8-tuxcare.15.5.8-tuxcare.2 |
5.5.8-tuxcare.3 |
org.springframework.security:spring-security-webMaven |
6.5.0 up to 6.5.11, plus listed versions 6.5.16.5.106.5.26.5.36.5.4 Show 5 moreShow less6.5.56.5.66.5.76.5.86.5.9 |
6.5.11 |
org.springframework.security:spring-security-webMaven |
6.4.0 to 6.4.13, plus listed versions 6.4.16.4.106.4.116.4.126.4.2 Show 7 moreShow less6.4.36.4.46.4.56.4.66.4.76.4.86.4.9 |
None known |
org.springframework.security:spring-security-webMaven |
6.0.0 to 6.3.10, plus listed versions 6.0.16.0.26.0.36.0.46.0.5 Show 32 moreShow less6.0.66.0.76.0.86.1.06.1.16.1.26.1.36.1.46.1.56.1.66.1.76.1.86.1.96.2.06.2.16.2.26.2.36.2.46.2.56.2.66.2.76.2.86.3.06.3.16.3.26.3.36.3.46.3.56.3.66.3.76.3.86.3.9 |
None known |
org.springframework.security:spring-security-webMaven |
5.8.0 to 5.8.16, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 10 moreShow less5.8.145.8.155.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9 |
None known |
org.springframework.security:spring-security-webMaven |
through 5.7.14, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 45 moreShow less3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE |
None known |
io.root.org.springframework.security:spring-security-webRoot:Maven |
before 6.3.3-root.io.1781450698 | 6.3.3-root.io.17814506986.2.0-root.io.36.5.9-root.io.36.2.0-root.io.46.5.9-root.io.46.2.0-root.io.56.5.9-root.io.5 |
org.springframework.security:spring-security-webRoot:Maven |
before 6.3.3-aikido.1781450698 | 6.3.3-aikido.17814506986.2.0-aikido.36.5.9-aikido.36.2.0-aikido.46.5.9-aikido.46.2.0-aikido.56.5.9-aikido.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47838 is a medium vulnerability (CVSS 6.8) in Spring Security, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in org.springframework.security:spring-security-web 6.5.11.
References
Left out here: 122 versions. The JSON record has them.