CVE-2026-10532 — Logback deserialization whitelist bypass for Proxy objects

Affected: QOS.CH Sarl logback

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.

More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.

Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions.

This issue affects logback: through 1.5.33 inclusive.

GHSA-293q-567p-wmwq — Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

Affected: Maven: org.springframework.security:spring-security-web

In Spring Security Web, `SubjectDnX509PrincipalExtractor` does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

`SubjectDnX509PrincipalExtractor` is deprecated by this CVE and replaced with `SubjectX500PrincipalExtractor`. As part of updating, you should also migrate to `SubjectX500PrincipalExtractor`.

Affected versions: Spring Security Enterprise 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. OSS 6.5.0 through 6.5.10.

Most recent entries from all

CVE-2026-10532 — Logback deserialization whitelist bypass for Proxy objects

GHSA-293q-567p-wmwq — Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates