Executive brief
Spring Framework's UrlHandlerFilter, a core component that routes web requests in Java applications, can be tricked into redirecting users to arbitrary external websites when configured with overly broad matching patterns. An attacker could craft a malicious link to redirect users to phishing sites or other malicious domains, potentially compromising user credentials or spreading malware.
Technical details
The vulnerability is an open redirect flaw in Spring Framework's UrlHandlerFilter component, which is present in both Spring MVC and Spring WebFlux variants. When the filter is configured with overly broad URL matching patterns, an attacker can craft a specially designed request to cause the filter to redirect the user to an arbitrary external URL. The attack requires user interaction (clicking a malicious link) and network accessibility to the affected application. Successful exploitation allows an attacker to redirect users to untrusted sites, facilitating phishing attacks or credential theft. Patches are available in Spring Framework versions beyond 7.0.8 and 6.2.19.
Affected products
- VMware Spring Framework 7.0.0 to 7.0.8, 6.2.0 to 6.2.19
Timeline
- 2026-08-27: published