diff --git a/advisories/unreviewed/2026/06/GHSA-7m2p-62gw-p8qq/GHSA-7m2p-62gw-p8qq.json b/advisories/unreviewed/2026/06/GHSA-7m2p-62gw-p8qq/GHSA-7m2p-62gw-p8qq.json index 72a3af3e7a06e..4cf0568813ecb 100644 --- a/advisories/unreviewed/2026/06/GHSA-7m2p-62gw-p8qq/GHSA-7m2p-62gw-p8qq.json +++ b/advisories/unreviewed/2026/06/GHSA-7m2p-62gw-p8qq/GHSA-7m2p-62gw-p8qq.json @@ -1,19 +1,59 @@ { "schema_version": "1.4.0", "id": "GHSA-7m2p-62gw-p8qq", - "modified": "2026-06-09T06:31:58Z", + "modified": "2026-06-09T06:32:07Z", "published": "2026-06-09T06:31:58Z", "aliases": [ "CVE-2026-41854" ], - "details": "Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.", + "summary": "Spring Framework Server-Side Request Forgery via UriComponentsBuilder", + "details": "Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework:spring-web" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.0.7.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework:spring-web" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.2.0" + }, + { + "fixed": "6.2.18.1" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY",