IP Classification Flaw in Spring Security 7.1.0 InetAddressMatcher
CVE-2026-59277 Published on August 27, 2026

Spring Security InetAddressMatchers Incomplete Internal Network Classification
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0

NVD

Vulnerability Analysis

CVE-2026-59277 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Products Associated with CVE-2026-59277

Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.

VMware Spring Framework
 

Affected Versions

Spring Security Version 7.1.0 is affected by CVE-2026-59277