IP Address Disclosure

Spring Security is vulnerable to IP address disclosure. The vulnerability is due to improper IP classification logic in the InetAddressMatchers utility, where the matchInternal and matchExternal builders can be manipulated to incorrectly classify private IP addresses as public, allowing an attack...

CVE-2026-59277: Protection Mechanism Failure

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...