Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.springframework.security/spring-security-web@7.0.5
purl pkg:maven/org.springframework.security/spring-security-web@7.0.5
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-1v2g-swwv-nqan Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4. CVE-2026-22747
GHSA-2jrg-rf5x-568g

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-01T20:52:13.263230+00:00 GHSA Importer Fixing VCID-1v2g-swwv-nqan https://github.com/advisories/GHSA-2jrg-rf5x-568g 38.6.0