Input validation error in Spring Framework - CVE-2026-41854

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU146415

Input validation error in Spring Framework - CVE-2026-41854

Published: August 31, 2026


Vulnerability identifier: #VU146415
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41854
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to incorrect host parsing in uricomponentsbuilder when parsing and validating an externally provided URL string. A remote attacker can supply a crafted URL string to perform server-side request forgery.

User interaction is required.


Affected software

Spring Framework
Db2 Developer Extension
IBM Sterling B2B Integrator
IBM Sterling File Gateway

How to mitigate CVE-2026-41854

Install security update from vendor's website.

Spring Framework - addressed in versions 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8
Db2 Developer Extension - update to 1.2.0
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling File Gateway - addressed in versions 6.2.1.2.1, 6.2.2.1.1

External References

Related Security Bulletins