Bug 2525241 (CVE-2026-59277)
| Summary: | CVE-2026-59277 org.springframework.security/spring-security-core: Spring Security: Information disclosure due to incomplete internal network classification | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | aschwart, aszczucz, boliveir, drichtar, gmalinko, janstey, mposolda, pdelbell, pjindal, rmartinc, rstepani, sdawley, ssilvert, sthorger, vmuzikar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
Spring Security InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network.
In Spring Security 7.1.0, the internal address classification did not recognize the IPv4 and IPv6 any local addresses (0.0.0.0 and ::) as internal. As a result, matchExternal() incorrectly classified these addresses as external, and matchInternal() failed to classify them as internal.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-27 20:19:19 UTC
|