Executive brief
Spring Framework, a widely used tool for building Java applications, contains a flaw in how it handles web addresses. If an application uses a specific component to process user-provided links, an attacker could potentially trick the system into making unauthorized requests to internal or external servers. This could lead to the exposure of sensitive internal data or unauthorized actions performed by the server.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Spring Framework's UriComponentsBuilder component due to incorrect host parsing logic. When an application uses this component to validate or construct URLs from untrusted user input, an attacker can craft a malicious URL that bypasses validation checks. This allows the attacker to induce the server to make requests to unintended destinations, potentially accessing internal services or metadata. The vulnerability affects Spring Framework versions 7.0.0-7.0.7 and 6.2.0-6.2.18, and is resolved in versions 7.0.8 and 6.2.19.
Affected products
- Spring Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-08-06: patched: Updated advisory with patched versions 7.0.8 and 6.2.19