GHSA-7m2p-62gw-p8qq
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework:spring-web | >= 7.0.0, < 7.0.8 | 7.0.8 |
| Maven | org.springframework:spring-web | >= 6.2.0, < 6.2.19 | 6.2.19 |
Details
As written in the advisory (Markdown source, shown as plain text).
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
References
External links from the advisory. They lead to third-party sites.