Loading vulnerability…
SSRF in Spring Framework UriComponentsBuilder
CVE-2026-41854 is a server-side request forgery vulnerability caused by incorrect host parsing in Spring Framework's UriComponentsBuilder, part of the spring-web component. Applications that use this class to parse and validate externally supplied URLs before making server-side requests may allow crafted URLs to bypass intended destination restrictions. Affected versions are Spring Framework 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause an affected application to issue unintended server-side requests to internal or otherwise restricted resources, potentially disclosing information or performing unauthorized operations against reachable services. The vulnerability-specific CVSS v3.0 score is 6.5, with low confidentiality and integrity impacts and no availability impact. Actual consequences depend on application behavior and the resources accessible from the server.
If you can’t patch tonight, do this now.
A vulnerability-specific interim workaround is not currently available.
Patch, then assume compromise.
Upgrade Spring Framework spring-web and related dependencies to 7.0.8 or later within the 7.0.x branch, or 6.2.19 or later within the 6.2.x branch. For affected packaged products, install the applicable vendor security update; Oracle Primavera Gateway 21.12.0 through 21.12.18 is addressed by Oracle's October 2026 Critical Patch Update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.