Read the docs
TI-2026-30264 Aliases CVE-2026-41854GHSA-7m2p-62gw-p8qq

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

Priority LOW 28CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00123 2nd percentileScored 2026-11-07
Fix Partial Spring Framework (Spring): 7.0.7.1, 6.2.18.1org.springframework:spring-web (Maven): 7.0.8, 6.2.19Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Framework7.0.0 to before 7.0.7.1; 6.2.0 to before 6.2.18.17.0.7.1, 6.2.18.1Patch availableCNA
—org.springframework:spring-web (Maven)7.0.0 to before 7.0.87.0.8Patch availableGHSA-7m2p-62gw-p8qq
—org.springframework:spring-web (Maven)6.2.0 to before 6.2.196.2.19Patch availableGHSA-7m2p-62gw-p8qq
  • Spring Framework VendorVMware Affected 7.0.0 to before 7.0.7.1; 6.2.0 to before 6.2.18.1 Fixed in 7.0.7.1, 6.2.18.1 Patch available CNA
  • org.springframework:spring-web (Maven) Vendor— Affected 7.0.0 to before 7.0.8 Fixed in 7.0.8 Patch available GHSA-7m2p-62gw-p8qq
  • org.springframework:spring-web (Maven) Vendor— Affected 6.2.0 to before 6.2.19 Fixed in 6.2.19 Patch available GHSA-7m2p-62gw-p8qq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*6.2.0 to before 6.2.18.1; 7.0.0 to before 7.0.7.1VulnerableVMware
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions 6.2.0 to before 6.2.18.1; 7.0.0 to before 7.0.7.1 Vulnerable ·VMware

Remediation

  • Fix · CNA Spring Framework (Spring) Fixed in 7.0.7.1, 6.2.18.1
  • Fix · GHSA-7m2p-62gw-p8qq org.springframework:spring-web (Maven) Fixed in 7.0.8 Advisory →
  • Fix · GHSA-7m2p-62gw-p8qq org.springframework:spring-web (Maven) Fixed in 6.2.19 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41854
  2. 2026-10-03 Alias added: GHSA-7m2p-62gw-p8qq

References

Advisory 2

Other 1

  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
  • TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
  • TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences