Aller au contenu
en Se connecter
4.2 Moyenne

CVE-2026-41854 Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally…

Description

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring Framework 7.0 7.0.0 → < 7.0.7.1 7.0.7.1
Spring Framework 6.2 6.2.0 → < 6.2.18.1 6.2.18.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Spring Framework

Les 45 CVE de Spring Framework →
CVE-2026-59314 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response… 3.7 Faible CVE-2026-59313 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent… 9.8 Critique CVE-2026-59283 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable… 9.1 Critique CVE-2026-59282 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a… 7.5 Élevée
Suivre cette CVE