CVE-2026-41854: Spring Framework Server-Side Request Forgery via UriComponentsBuilder

June 9, 2026 (updated August 6, 2026)

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

References

github.com/advisories/GHSA-7m2p-62gw-p8qq
nvd.nist.gov/vuln/detail/CVE-2026-41854
spring.io/security/cve-2026-41854

Code Behaviors & Features

Detect and mitigate CVE-2026-41854 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →