CVE-2026-41854 Overview
CVE-2026-41854 is a server-side request forgery (SSRF) vulnerability in the Spring Framework's UriComponentsBuilder utility. The flaw stems from incorrect host parsing when the builder processes externally supplied URL strings. Applications that rely on UriComponentsBuilder to parse and validate user-supplied URLs may route requests to unintended internal hosts. The issue affects Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Attackers can bypass URL validation logic to coerce backend services into issuing HTTP requests to internal infrastructure, potentially exposing cloud metadata endpoints or internal APIs.
Affected Products
- Spring Framework 7.0.0 through 7.0.7
- Spring Framework 6.2.0 through 6.2.18
- Applications using UriComponentsBuilder for URL parsing and validation
Discovery Timeline
- 2026-06-09 - CVE-2026-41854 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-41854
Vulnerability Analysis
The vulnerability resides in Spring Framework's UriComponentsBuilder, a widely used utility for constructing and parsing URI components. When the builder parses an externally supplied URL, it extracts the host component using logic that diverges from RFC 3986 semantics. The parsed host value returned by the builder can differ from the host that an HTTP client subsequently resolves and connects to.
Applications commonly use UriComponentsBuilder as a defensive layer. Developers parse the supplied URL, inspect the host against an allowlist or blocklist, and then pass the original string to an outbound HTTP client. Because the parser and the client interpret the host differently, validation decisions can be made against a benign-looking host while the actual request reaches an attacker-controlled target.
Root Cause
The root cause is inconsistent host extraction inside UriComponentsBuilder. Crafted URL strings containing ambiguous authority components, embedded credentials, or unusual delimiters cause the parser to report a host that does not match the host parsed by downstream HTTP libraries. This parser discrepancy breaks the validation contract that applications assume.
Attack Vector
An attacker submits a malicious URL through any input that an application processes with UriComponentsBuilder, such as webhook configuration fields, image fetchers, OpenID Connect discovery endpoints, or URL preview features. The application validates the parsed host and approves the request. The downstream HTTP client then resolves a different host, allowing the request to reach internal services like cloud instance metadata (169.254.169.254), internal admin panels, or service mesh control planes. Successful exploitation requires user interaction with the affected endpoint, per the CVSS metrics published with the advisory.
No verified exploit code is publicly available. See the Spring Security Advisory CVE-2026-41854 for vendor-provided technical details.
Detection Methods for CVE-2026-41854
Indicators of Compromise
- Outbound HTTP requests from application servers to RFC 1918 ranges, link-local addresses (169.254.0.0/16), or loopback addresses not present in baseline traffic.
- Application logs showing URL validation accepting a host that differs from the resolved destination in proxy or egress logs.
- Requests to cloud metadata endpoints (/latest/meta-data/, /computeMetadata/v1/) originating from services that should not access them.
Detection Strategies
- Correlate parsed host values logged at the application layer with destination IPs recorded by egress proxies to surface parser-vs-resolver mismatches.
- Inspect URL inputs for embedded credentials (user@host), backslashes, and multiple @ symbols, which are common indicators of parser confusion payloads.
- Identify Spring applications running affected versions through software composition analysis of spring-web dependencies.
Monitoring Recommendations
- Enable egress logging on application workloads and alert on connections to internal CIDR ranges from services that historically only call external APIs.
- Block or alert on access to cloud metadata service IPs from container and VM workloads that do not require it.
- Track UriComponentsBuilder parsing exceptions and host validation rejections to baseline normal input patterns.
How to Mitigate CVE-2026-41854
Immediate Actions Required
- Upgrade Spring Framework to a patched release above 7.0.7 in the 7.0.x line or above 6.2.18 in the 6.2.x line as published in the vendor advisory.
- Inventory all code paths that call UriComponentsBuilder.fromUriString() or fromHttpUrl() against externally supplied input and confirm patch coverage.
- Restrict outbound network access from application workloads to an explicit allowlist of required destinations.
Patch Information
Pivotal/Broadcom published fixed releases as described in the Spring Security Advisory CVE-2026-41854. Apply the corresponding Spring Framework maintenance release for your branch and rebuild affected applications. Confirm transitive dependencies in Spring Boot and Spring Cloud projects also pull the patched spring-web artifact.
Workarounds
- Perform host validation using java.net.URI directly and reject inputs where the URI authority does not match the host returned by UriComponentsBuilder.
- Resolve the supplied URL once, extract the final destination IP, and validate that IP against an allowlist before issuing the outbound request.
- Deploy an outbound HTTP proxy that enforces host allowlisting independently of application-layer parsing.
# Maven dependency override example (adjust to vendor-published fixed version)
mvn dependency:tree -Dincludes=org.springframework:spring-web
# Update spring-framework.version in your build to the patched release
# then verify the resolved version
mvn dependency:list | grep spring-web
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
