Executive brief
Spring Security's InetAddressMatchers utility incorrectly classifies IP addresses as internal or external, potentially allowing requests to bypass network-based access controls. An attacker could exploit this misclassification to reach resources that should only be accessible from specific network locations, compromising network segmentation and security policies.
Technical details
The vulnerability exists in Spring Security's InetAddressMatchers utility, which provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies IP addresses as belonging to internal (private) or external (public) networks. The root cause appears to be a flaw in the IP classification logic that incorrectly categorizes certain IP addresses. An attacker with network access can send requests with specially crafted IP addresses to bypass IP-based access controls. This affects applications relying on Spring Security's IP address matching for network segmentation or geo-based restrictions.
Affected products
- Spring Spring Security 7.1.0
Timeline
- 2026-08-27: disclosed