Skip to content
fr Sign in
4.2 Medium

CVE-2026-41854 Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally…

Description

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

Affected products and versions

Product Affected versions Fixed in
Spring Framework 7.0 7.0.0 → < 7.0.7.1 7.0.7.1
Spring Framework 6.2 6.2.0 → < 6.2.18.1 6.2.18.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Framework

The 45 CVEs of Spring Framework →
CVE-2026-59314 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response… 3.7 Low CVE-2026-59313 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent… 9.8 Critical CVE-2026-59283 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable… 9.1 Critical CVE-2026-59282 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a… 7.5 High
Track this CVE