CVE-2026-59277

Analyzed Analyzed - Analysis Complete

Spring Security InetAddressMatchers IP Classification Flaw

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59277

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_security	From 7.1.0 (inc) to 7.1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability affects Spring Security's InetAddressMatchers utility which classifies IP addresses as internal or external. The methods matchInternal() and matchExternal() incorrectly handle IPv4 and IPv6 'any local' addresses (0.0.0.0 and ::). Instead of recognizing them as internal, matchExternal() classifies them as external and matchInternal() fails to classify them as internal.

Detection Guidance

To detect this vulnerability, check if your Spring Security version is 7.1.0. Run commands like 'find / -name spring-security-core*.jar' or check dependency files (e.g., pom.xml, build.gradle) for version 7.1.0. Verify if InetAddressMatchers.matchInternal() or matchExternal() is used in your codebase.

Impact Analysis

This vulnerability could allow an attacker to bypass network-based access control checks if the application relies on these methods for access decisions. Since 0.0.0.0 or :: typically routes to the local host, misclassification may lead to unauthorized access.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR or HIPAA if the affected application relies on network-based access controls to protect sensitive data. Misclassification of IP addresses might allow unauthorized access to systems handling personal or health data, violating data protection requirements.

Mitigation Strategies

Upgrade Spring Security to version 7.1.1 or later. No additional mitigation steps are required beyond the upgrade. Verify the upgrade by checking the version in your dependency files or runtime environment.

Hi! I’m here to help you understand CVE-2026-59277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70