{"id":"ECHO-e311-90be-2fe3","summary":"Incorrect IPv6 host parsing in RfcUriParser, the RFC 3986 parser UriComponentsBuilder\nuses as of 6.2 (added by commit 52805da733, first released in 6.2.0; the advisory range is\n6.2.0 - 6.2.18 and 7.0.0 - 7.0.7). 5.3.20 has no RfcUriParser: UriComponentsBuilder parses\nwith the URI_PATTERN/HTTP_URL_PATTERN regexes, hardened here by the CVE-2024-22243/22259/22262\npatches. The fix ce90e4b11f only changes RfcUriParser.\n","modified":"2026-11-04T13:15:05.625574952Z","published":"2026-10-07T00:00:48.724Z","withdrawn":"2026-11-03T21:45:06.385Z","upstream":["CVE-2026-41854","GHSA-7m2p-62gw-p8qq"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-41854"},{"type":"WEB","url":"https://github.com/advisories/GHSA-7m2p-62gw-p8qq"}],"affected":[{"package":{"name":"org.springframework:spring-web","ecosystem":"Echo:Maven","purl":"pkg:maven/org.springframework/spring-web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.20+echo.1"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-e311-90be-2fe3.json"}}],"schema_version":"1.9.2"}