CVE-2026-59277
published 2026-08-27CVE-2026-59277: Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.29%
21.1th percentile
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network.
Spring Security 7.1.0
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| spring | spring_security | — | — |
| vmware | spring_security | >= 7.1.0 < 7.1.0.1 | 7.1.0.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an interna
ghsa_unreviewed·2026-08-27
CVE-2026-59277 [LOW] CWE-693 Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an interna
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network.
Spring Security 7.1.0
VulDB
VMware Spring Security 7.1.0 InetAddressMatchers matchInternal/matchExternal protection mechanism
vuldb·2026-08-27·CVSS 3.7
CVE-2026-59277 [LOW] VMware Spring Security 7.1.0 InetAddressMatchers matchInternal/matchExternal protection mechanism
A vulnerability was found in VMware Spring Security 7.1.0 and classified as critical. The affected element is the function matchInternal/matchExternal of the component InetAddressMatchers. Executing a manipulation can lead to protection mechanism failure.
This vulnerability appears as CVE-2026-59277. The attack may be performed from remote. There is no available exploit.
Red Hat
org.springframework.security/spring-security-core: Spring Security: Information disclosure due to incomplete internal network classification
vendor_redhat·2026-08-27·CVSS 5.3
CVE-2026-59277 [MEDIUM] CWE-184 org.springframework.security/spring-security-core: Spring Security: Information disclosure due to incomplete internal network classification
org.springframework.security/spring-security-core: Spring Security: Information disclosure due to incomplete internal network classification
Spring Security InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network.
In Spring Security 7.1.0, the internal address classification did not recognize the IPv4 and IPv6 any local addresses (0.0.0.0 and ::) as internal. As a result, matchExternal() incorrectly classified these addresses as external, and matchInternal() failed to classify them as internal.
Statement: A flaw was found in Spring Security 7.1.0 where the InetAddressMatchers utility does not correctly classify IPv4 and IPv
No detection rules found.
No public exploits indexed.
2026-08-27
Published