CVE-2026-41854 is a Server-Side Request Forgery (SSRF) vulnerability in the Spring Framework caused by incorrect host parsing in the UriComponentsBuilder component. Applications that parse and validate externally provided URL strings using this component may be exposed to SSRF attacks, potentially allowing attackers to induce the server to make unauthorized requests. The affected versions are Spring Framework 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18. The vulnerability has been assigned a CVSS 3.1 base score of 4.2, indicating medium severity. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to exploit incorrect URL host parsing to perform SSRF attacks, which can lead to unauthorized internal or external network requests initiated by the vulnerable application. The impact is limited to low confidentiality and integrity loss, with no availability impact reported. This could potentially expose internal services or sensitive information accessible from the server's network context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when using UriComponentsBuilder to parse and validate externally supplied URLs. Consider implementing additional validation or filtering of URLs before processing. Monitor vendor channels for updates and apply patches promptly once available.