Spring Framework Server-Side Request Forgery via UriComponentsBuilder

🗓️ 09 Jun 2026 06:31:58Reported by GitHub Advisory DatabaseType

Spring Framework SSRF via UriComponentsBuilder from incorrect host parsing in 7.0.x and 6.2.x.

Reporter	Title	Published	Views	Family All 39
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854]	27 Jul 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Cross-site Scripting attacks, Denial of Service (DoS) attacks, and Server-Side Request Forgery attacks	26 Jun 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	21 Jul 202605:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:33	–	ibm
CNNVD	VMware Spring Framework 代码问题漏洞	9 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41854	9 Jun 202603:51	–	cve
Cvelist	CVE-2026-41854 Spring Framework Server-Side Request Forgery via UriComponentsBuilder	9 Jun 202603:51	–	cvelist
Debian CVE	CVE-2026-41854	9 Jun 202603:51	–	debiancve
EUVD	EUVD-2026-35343	9 Jun 202603:51	–	euvd
F5 Networks	K000162319: Spring Framework vulnerability CVE-2026-41854	17 Jul 202615:23	–	f5