Spring Security's InetAddressMatchers utility offers matchInternal() and matchExternal() builders that are supposed to classify addresses as belonging to internal or external networks. The vulnerability stems from a flaw that makes the classification incomplete, potentially treating an internal address as external or vice‑versa. Because many security rules depend on this classification—such as origin checks, CSRF protections, or access restrictions—an attacker could trick the application into treating a controlled internal request as an external one, allowing bypass of intended safeguards. The impact is limited to authority and availability compromises rather than direct code execution.

The affected product is Spring Security, specifically version 7.1.0. No other affected versions were listed.

The CVSS score is 3.7, indicating low severity. EPSS data is not available, so exploitation probability cannot be quantified from public data. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploits have been documented. The likely attack vector is through any input that is passed to matchInternal()/matchExternal() in an application context; however, specific conditions or prerequisites are not detailed in the description, so the exploitation complexity is assumed to be low to moderate. Once the classification is inaccurate, an attacker may leverage other application weaknesses to gain unauthorized access or cause a denial of service.