From c9220ca39e696c2acc93147c0ec3d853a4a10859 Mon Sep 17 00:00:00 2001
From: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Date: Sat, 11 Jul 2026 21:12:25 -0600
Subject: [PATCH] Align Null Behavior

Previously, ExternalInetAddressMatcher treated a null InetAddress
as external by negating InternalInetAddressMatcher's result.

This commit makes ExternalInetAddressMatcher return false for a
null address, so that neither the internal nor the external
matcher classifies an unknown address as a match.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
---
 .../security/util/matcher/InetAddressMatchers.java          | 3 +++
 .../security/util/matcher/InetAddressMatchersTests.java     | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/core/src/main/java/org/springframework/security/util/matcher/InetAddressMatchers.java b/core/src/main/java/org/springframework/security/util/matcher/InetAddressMatchers.java
index dbe4e7be65..cc77211f11 100644
--- a/core/src/main/java/org/springframework/security/util/matcher/InetAddressMatchers.java
+++ b/core/src/main/java/org/springframework/security/util/matcher/InetAddressMatchers.java
@@ -335,6 +335,9 @@ public final class InetAddressMatchers {
 
 		@Override
 		public boolean matches(@Nullable InetAddress address) {
+			if (address == null) {
+				return false;
+			}
 			return !this.internalMatcher.matches(address);
 		}
 
diff --git a/core/src/test/java/org/springframework/security/util/matcher/InetAddressMatchersTests.java b/core/src/test/java/org/springframework/security/util/matcher/InetAddressMatchersTests.java
index 387af3c381..3df99ccea9 100644
--- a/core/src/test/java/org/springframework/security/util/matcher/InetAddressMatchersTests.java
+++ b/core/src/test/java/org/springframework/security/util/matcher/InetAddressMatchersTests.java
@@ -415,6 +415,12 @@ class InetAddressMatchersTests {
 	@Nested
 	class ExternalInetAddressMatcherTests {
 
+		@Test
+		void matchesWhenInetAddressNullThenReturnsFalse() {
+			InetAddressMatcher matcher = InetAddressMatchers.matchExternal().build();
+			assertThat(matcher.matches((InetAddress) null)).isFalse();
+		}
+
 		@ParameterizedTest
 		@ValueSource(strings = { "8.8.8.8", "1.1.1.1" })
 		void matchesWhenIpv4PublicThenReturnsTrue(String address) throws Exception {