Junglewise Threat Intelligence

CVE-2026-59277: Spring Security InetAddressMatchers IP classification bypass

CVE-2026-59277 · Severity: low · CVSS 3.7 · Published 2026-08-27

Executive brief

Spring Security's InetAddressMatchers utility incorrectly classifies IP addresses as internal or external, potentially allowing requests to bypass network-based access controls. An attacker could exploit this misclassification to reach resources that should only be accessible from specific network locations, compromising network segmentation and security policies.

Technical details

The vulnerability exists in Spring Security's InetAddressMatchers utility, which provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies IP addresses as belonging to internal (private) or external (public) networks. The root cause appears to be a flaw in the IP classification logic that incorrectly categorizes certain IP addresses. An attacker with network access can send requests with specially crafted IP addresses to bypass IP-based access controls. This affects applications relying on Spring Security's IP address matching for network segmentation or geo-based restrictions.

Affected products

  • Spring Spring Security 7.1.0

Timeline

  • 2026-08-27: disclosed

References

Related threats