ECHO-e311-90be-2fe3

See a problem?

Import Source

https://advisory.echohq.com/osv/ECHO-e311-90be-2fe3.json

JSON Data

https://api.test.osv.dev/v1/vulns/ECHO-e311-90be-2fe3

Upstream

Withdrawn

2026-11-03T21:45:06Z

Published

2026-10-07T00:00:48Z

Modified

2026-11-04T13:15:05Z

Summary

Incorrect IPv6 host parsing in RfcUriParser, the RFC 3986 parser UriComponentsBuilder uses as of 6.2 (added by commit 52805da733, first released in 6.2.0; the advisory range is 6.2.0 - 6.2.18 and 7.0.0 - 7.0.7). 5.3.20 has no RfcUriParser: UriComponentsBuilder parses with the URI_PATTERN/HTTP_URL_PATTERN regexes, hardened here by the CVE-2024-22243/22259/22262 patches. The fix ce90e4b11f only changes RfcUriParser.

Details

References

Affected packages

Echo:Maven / org.springframework:spring-web

Package

Name: org.springframework:spring-web
Purl: pkg:maven/org.springframework/spring-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.3.20+echo.1

Database specific

source

"https://advisory.echohq.com/osv/ECHO-e311-90be-2fe3.json"