CVE-2026-41854

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-41854
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

4.2 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://spring.io/security/cve-2026-41854 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
History

15 Jun 2026, 19:10

Type Values Removed Values Added
CPE cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
First Time Vmware
Vmware spring Framework
References () https://spring.io/security/cve-2026-41854 - () https://spring.io/security/cve-2026-41854 - Vendor Advisory

09 Jun 2026, 05:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-09 05:16

Updated : 2026-06-15 19:10

NVD link : CVE-2026-41854

Mitre link : CVE-2026-41854

CVE.ORG link : CVE-2026-41854

JSON object : View

Products Affected

vmware

  • spring_framework
CWE
CWE-918

Server-Side Request Forgery (SSRF)