The vulnerability stems from faulty host parsing performed by Spring Framework’s UriComponentsBuilder. When user‑supplied URL strings are processed without adequate validation, an attacker can craft a request that causes the server to contact arbitrary internal or external resources. This can lead to disclosure of sensitive data, cross‑system lateral movement, or denial‑of‑service conditions, all falling under the CWE‑918 category of server‑side request forgery.

Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18 are affected. The issue is specific to applications that incorporate UriComponentsBuilder for URL parsing and validation.

The CVSS score of 4.2 indicates a moderate severity, while the EPSS score is currently unavailable and the vulnerability is not listed in KEV. An attacker would need to supply a specially crafted URL that triggers UriComponentsBuilder, which are typically invoked via HTTP requests. Given that the vulnerability only manifests when applications accept untrusted URLs, the likelihood of exploitation in the absence of such functionality is relatively low, yet the potential impact warrants prompt remediation. Continuous monitoring for exploitation attempts is advised until a patch is applied.