MEDIUM 4.2 Maven
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
GHSA-7m2p-62gw-p8qq · CVE-2026-41854
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
Ready to move
Start Securing
Free, no credit card | First findings in minutes