Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2026-41854

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Framework

Default version status: unaffected

  • 7.0.0 to < 7.0.7.1affected
  • 6.2.0 to < 6.2.18.1affected

References