CVE-2026-59277: Spring Security InetAddressMatchers Incomplete Internal Network Classification
Published Aug 27, 2026
·Updated
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0
Affected Software
1 affected component
Spring Spring Security=7.1.0
Event History
Aug 27, 2026
CVE Published
via MITRE·05:57 PM
Data Sourced
via MITRE·05:57 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverity
Frequently Asked Questions
1
Which deployments should be reviewed first?
Review applications using Spring Security 7.1.0 that rely on InetAddressMatchers matchInternal() or matchExternal() for IP-based access-control decisions.
2
Is there evidence that confidentiality, integrity, or availability is broadly impacted?
The provided severity vector indicates low severity with low confidentiality impact and no stated integrity or availability impact. Exploitation is network-accessible but has high attack complexity and requires no privileges or user interaction.