IP Address Disclosure

Spring Security is vulnerable to IP address disclosure. The vulnerability is due to improper IP classification logic in the InetAddressMatchers utility, where the matchInternal and matchExternal builders can be manipulated to incorrectly classify private IP addresses as public, allowing an attack...

CVE-2026-59277

Spring Security InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. In Spring Security 7.1.0, the internal address classification did...

CVE-2026-59277

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

EUVD-2026-67169

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277

Spring Security 7.1.0 contains a misclassification flaw in the InetAddressMatchers utility. The matchInternal() and matchExternal() builders fail to recognize the IPv4 and IPv6 any-local addresses (0.0.0.0 and :: ) as internal, causing matchExternal() to classify them as external. This enables ac...

CVE-2026-59277: Protection Mechanism Failure

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

PT-2026-82691

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Description The InetAddressMatchers utility provides matchInternal and matchExternal builders used to create an InetAddressMatcher. This component is responsible for classifying whether a provided IP address belon...

Access Control Bypass

Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Access Control Bypass in the InetAddressMatchers process. An attacker can bypass network-based access control...

cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification

cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification...