CVE-2026-41854CWE-918

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

Medium · published June 9, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
10.5
In the wild
Unconfirmed
What it is

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.

Affected versions:

Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-09T03:51Z
EPSS history
Timeline
  • 09 JUN 03:51Z
    Spring Framework Server-Side Request Forgery via UriComponentsBuilder
    cvelistv5