CVE-2026-41854
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The vulnerability in Spring Framework is caused by incorrect host parsing in UriComponentsBuilder. Applications using this component to parse and validate externally provided URLs may be exposed to an SSRF (Server-Side Request Forgery) attack.
Risk Assessment
An attacker can exploit this flaw to send requests from the server to internal network resources, potentially leading to unauthorized access to data or services.
Recommendation
It is recommended to immediately update Spring Framework to version 7.0.8 or later (for the 7.0.x branch) and 6.2.19 or later (for the 6.2.x branch).
Original NVD description (English source)
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.