Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network.

The internal address classification did not recognize the IPv4 and IPv6 "any local" addresses (0.0.0.0 and ::) as internal. As a result, matchExternal() incorrectly classified these addresses as external, and matchInternal() failed to classify them as internal.

Your application may be affected if the following are true:

• You use InetAddressMatchers.matchInternal() or InetAddressMatchers.matchExternal() (directly or via a custom InetAddressMatcher built on top of them), and
• You rely on that classification to make an access control decision that should treat 0.0.0.0 or :: as an internal address

In that case, an address of 0.0.0.0 or ::, which is typically routed to the local host, could bypass a network-based access control check intended to restrict or block internal network access.