What is the CVSS score of CVE-2026-41854?

CVE-2026-41854 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41854?

Yes, a patch is available for CVE-2026-41854. Update the affected software to the latest version immediately.

Spring Framework CVE-2026-41854

EUVD-2026-35343 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-09 vmware

GHSA-7m2p-62gw-p8qq

Java SSRF Spring Framework Red Hat

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Red Hat

4.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 15, 2026 - 19:22 NVD

4.2 (MEDIUM) 6.5 (MEDIUM)

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:20 vuln.today

DescriptionNVD

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

AnalysisAI

Server-side request forgery (SSRF) in Spring Framework's UriComponentsBuilder affects applications that use this API to parse and validate externally supplied URL strings. Incorrect host parsing allows a remote, unauthenticated attacker - with user interaction - to cause the application server to issue requests to unintended internal or external destinations, exposing low-level confidentiality and integrity impacts. No public exploit identified at time of analysis and no CISA KEV listing; however, SSRF in widely deployed Java frameworks warrants attention in any internet-facing application that processes user-controlled URLs.

Technical ContextAI

UriComponentsBuilder is a core Spring Framework utility (package org.springframework.web.util) used to programmatically parse, build, and encode URIs. Applications commonly use it as a validation or normalization layer before following or forwarding externally supplied URLs. The root cause is classified as CWE-918 (Server-Side Request Forgery): the host component of a crafted URL is parsed incorrectly, causing the framework to resolve a different host than the one the application developer intended to validate or block. This can allow bypass of URL allowlists or deny-lists that rely on UriComponentsBuilder's parsed output. The vulnerability is present in the cpe:2.3:a:spring:spring_framework:*:*:*:*:*:*:*:* product line across the 6.2.x and 7.0.x release trains, both of which are actively maintained Java library releases distributed via Maven Central. The Java/SSRF/Spring Framework tags confirm this is exclusively a JVM ecosystem issue.

RemediationAI

Patch available per vendor advisory at https://spring.io/security/cve-2026-41854; the exact fixed version number is not confirmed from the data available at time of analysis - consult the Spring security advisory directly to identify the patched release for your branch (6.2.x or 7.0.x). Until a patch can be applied, the most actionable compensating control is to avoid using UriComponentsBuilder as the sole validation mechanism for externally supplied URLs: supplement or replace it with an explicit allowlist comparison performed on the raw, unparsed string before it is passed to UriComponentsBuilder, eliminating the bypass window. Applications that do not process externally provided URL strings through UriComponentsBuilder are not affected and require no action. Restricting outbound HTTP egress from the Spring application host to only explicitly required destinations via network-layer controls (firewall rules, security groups) limits the blast radius of any successful SSRF exploitation. Note that egress restrictions do not prevent exploitation but do reduce the attacker's ability to reach sensitive internal services such as cloud metadata endpoints.