Description

Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-27T20:17:53.987Z",
  "pubdate": "2026-08-27T20:17:53.987Z",
  "executiveSummary": "The Spring Security InetAddressMatchers utility in version 7.1.0 exhibits a critical logic flaw in its matchInternal() and matchExternal() methods.\nThis vulnerability is classified as an improper input validation or security bypass issue, where the utility fails to correctly categorize certain IP address ranges as internal or external.\nThe impact involves potential Server-Side Request Forgery (SSRF) or unauthorized access to internal network resources, as malicious entities may bypass network perimeter controls.\nAffected systems include applications leveraging Spring Security 7.1.0 for IP-based access control or network segmentation.\nThe risk implication is significant, as the vulnerability allows attackers to deceive security logic into treating hostile or public IP addresses as internal, or vice versa, circumventing established trust boundaries.\nExploitation requires an attacker to interact with a system that relies on these specific matchers for filtering or authorization decisions.",
  "technicalDetails": "The vulnerability resides within the InetAddressMatchers utility, specifically within the implementation of the matchInternal() and matchExternal() builders used to categorize InetAddress instances.\nThe root cause involves flawed CIDR or address-range parsing logic that fails to account for edge cases, non-standard IP formats, or specific network class definitions, leading to incorrect classification of IP addresses.\nWhen an application utilizes these matchers to enforce boundary security, the logic may incorrectly evaluate a public IP address as internal, or fail to flag a private IP address, thereby invalidating security policies based on these classifications.\nIn a typical attack flow, an attacker leverages a feature that allows them to influence or provide a destination IP address or hostname to a protected service. The service uses InetAddressMatchers to validate whether the target is permitted (e.g., preventing access to internal loopback or private ranges).\nBy crafting a request containing a malformed or specifically formatted IP address, the attacker exploits the ambiguity in the matchInternal() or matchExternal() evaluation process. If the library returns a false negative, the application proceeds under the mistaken belief that the connection is safe, facilitating unauthorized interactions with internal services.\nThe vulnerable component is the InetAddressMatcher interface and its associated builder logic. This affects Spring Security version 7.1.0.\nThe authentication and privilege requirements for this exploit are often low, as the bypass occurs at the network policy evaluation stage, frequently before or during the initial request handling cycle.\nNetwork exposure is high for applications that use these matchers to gate access to sensitive internal APIs or metadata services.\nPost-exploitation impact includes the ability to perform SSRF attacks, potentially bypassing firewalls or WAFs that are integrated with the application's internal security logic, leading to exfiltration of data from internal-only services, or unauthorized control plane access."
}