Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. The current implementation in Spring Security 7.1.0 has a flaw that makes this classification incomplete, potentially resulting in incorrect determination of whether an IP address is internal or external.

The affected product is Spring Security, version 7.1.0. No other affected versions were listed in the data.

The CVSS score is 3.7, indicating a low severity vulnerability. The EPSS score is < 1%, showing a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits. The attack vector is inferred as any use of matchInternal() or matchExternal() with user‑supplied IP addresses; however, specific exploitation conditions are not detailed in the description, so the overall risk remains low.