← CVE Intelligence

CVE-2026-41854

Spring Framework Server-Side Request Forgery via UriComponentsBuilder PUBLISHED

Description (CNA)

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

Affected (CNA)

Vendor / productVersions
Spring / Spring Frameworkaffected 7.0.0 before 7.0.7.1; affected 6.2.0 before 6.2.18.1

CWE

CWE-918

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.