Is CVE-2026-41854 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41854 being exploited in the wild.

How severe is CVE-2026-41854?

Medium severity, with a CVSS score of 4.2, published 9 June 2026.

Which products and versions are affected?

org.springframework:spring-web (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

Is there a fix for CVE-2026-41854?

Yes. org.springframework:spring-web (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41854 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41854?

Check whether you run org.springframework:spring-web (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41854: VMware Spring Framework SSRF in UriComponentsBuilder

CVE-2026-41854 · Severity: medium · CVSS 4.2 · Published 2026-06-09

Spring Framework, a widely used tool for building Java applications, contains a flaw in how it handles web addresses. If an application uses a specific component to process user-provided links, an attacker could potentially trick the system into making unauthorized requests to internal or external servers. This could lead to the exposure of sensitive internal data or unauthorized actions performed by the server.

Technologies: org.springframework:spring-web (Maven), VMware Spring Framework. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41854 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41854 being exploited in the wild.
How severe is CVE-2026-41854?: Medium severity, with a CVSS score of 4.2, published 9 June 2026.
Which products and versions are affected?: org.springframework:spring-web (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
Is there a fix for CVE-2026-41854?: Yes. org.springframework:spring-web (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41854 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41854?: Check whether you run org.springframework:spring-web (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework:spring-web (Maven): upgrade to 7.0.8 or later

# set org.springframework:spring-web to 7.0.8 in your pom.xml or build.gradle

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Spring Framework's UriComponentsBuilder component due to incorrect host parsing logic. When an application uses this component to validate or construct URLs from untrusted user input, an attacker can craft a malicious URL that bypasses validation checks. This allows the attacker to induce the server to make requests to unintended destinations, potentially accessing internal services or metadata. The vulnerability affects Spring Framework versions 7.0.0-7.0.7 and 6.2.0-6.2.18, and is resolved in versions 7.0.8 and 6.2.19.

Affected products

Spring Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18

Identifiers

CVE-2026-41854
GHSA-7m2p-62gw-p8qq

Timeline

2026-06-09: disclosed
2026-06-09: advisory
2026-08-06: patched: Updated advisory with patched versions 7.0.8 and 6.2.19

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.