CVE-2026-41854

🗓️ 17 Jul 2026 13:19:56Reported by redhat.comType

redhatcve🔗 access.redhat.com👁 20 Views

Spring Framework SSRF via UriComponentsBuilder host parsing flaw enables access to arbitrary domains.

Reporter	Title	Published	Views	Family All 73
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854]	27 Jul 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Cross-site Scripting attacks, Denial of Service (DoS) attacks, and Server-Side Request Forgery attacks	26 Jun 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway	15 Sep 202613:00	–	ibm
IBM Security Bulletins	Security Bulletin: spring-web-6.2.18.jar (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	21 Jul 202605:53	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Spring Framework affects IBM Netezza Appliance	12 Aug 202609:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for July 2026 - Multiple CVEs addressed	10 Aug 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:33	–	ibm
CNNVD	VMware Spring Framework 代码问题漏洞	9 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41854	9 Jun 202603:51	–	cve

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41854
spring	www.spring.io/security/cve-2026-41854
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

17 Jul 2026 13:19Current

4.9Medium risk

Vulners AI Score4.9

CVSS 3.14.2 - 6.5

EPSS0.00123

SSVC

spring framework server side request forgery host parsing flaw uri components builder arbitrary domains