From 9fdcc6104d2163916c6729797d84fa9a1292a8ab Mon Sep 17 00:00:00 2001
From: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Date: Thu, 18 Jun 2026 14:11:26 -0600
Subject: [PATCH] Check isAnyLocalAddress

This commit updates InternalInetAddressMatcher to check
InetAddress#isAnyLocalAddress in order to catch
additional IP addresses

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
---
 .../security/util/matcher/InetAddressMatchers.java       | 4 +++-
 .../security/util/matcher/InetAddressMatchersTests.java  | 9 +++++----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/core/src/main/java/org/springframework/security/util/matcher/InetAddressMatchers.java b/core/src/main/java/org/springframework/security/util/matcher/InetAddressMatchers.java
index dbe4e7be65..6ba23ff4f5 100644
--- a/core/src/main/java/org/springframework/security/util/matcher/InetAddressMatchers.java
+++ b/core/src/main/java/org/springframework/security/util/matcher/InetAddressMatchers.java
@@ -259,7 +259,9 @@ public final class InetAddressMatchers {
 			if (address.isLoopbackAddress() || address.isLinkLocalAddress() || address.isSiteLocalAddress()) {
 				return true;
 			}
-
+			if (address.isAnyLocalAddress()) {
+				return true;
+			}
 			byte[] rawAddress = address.getAddress();
 
 			if (rawAddress.length == 16) {
diff --git a/core/src/test/java/org/springframework/security/util/matcher/InetAddressMatchersTests.java b/core/src/test/java/org/springframework/security/util/matcher/InetAddressMatchersTests.java
index 387af3c381..9eb960a3b0 100644
--- a/core/src/test/java/org/springframework/security/util/matcher/InetAddressMatchersTests.java
+++ b/core/src/test/java/org/springframework/security/util/matcher/InetAddressMatchersTests.java
@@ -276,16 +276,17 @@ class InetAddressMatchersTests {
 		}
 
 		@ParameterizedTest
-		@ValueSource(strings = { "127.0.0.1", "127.0.0.255" })
+		@ValueSource(strings = { "127.0.0.1", "127.0.0.255", "0.0.0.0" })
 		void matchesWhenIpv4LoopbackThenReturnsTrue(String address) throws Exception {
 			InetAddressMatcher matcher = InetAddressMatchers.matchInternal().build();
 			assertThat(matcher.matches(InetAddress.getByName(address))).isTrue();
 		}
 
-		@Test
-		void matchesWhenIpv6LoopbackThenReturnsTrue() throws Exception {
+		@ParameterizedTest
+		@ValueSource(strings = { "::1", "::" })
+		void matchesWhenIpv6LoopbackThenReturnsTrue(String address) throws Exception {
 			InetAddressMatcher matcher = InetAddressMatchers.matchInternal().build();
-			assertThat(matcher.matches(InetAddress.getByName("::1"))).isTrue();
+			assertThat(matcher.matches(InetAddress.getByName(address))).isTrue();
 		}
 
 		@ParameterizedTest