The issue arises from insufficient validation of user-input data in the Spring Framework, potentially allowing an attacker to perform a Server-Side Request Forgery (SSRF) attack or an open redirect attack. This can occur when applications use UriComponentsBuilder to parse externally provided URLs and then perform validation checks on the host of the parsed URL. If the URL is used after passing these validation checks, it may be vulnerable to such attacks. The vulnerability can be exploited by including a left square bracket symbol in the user info segment of a URL, which can lead to the UriComponentsBuilder returning a host name that differs from the interpretation of major browsers, thus potentially bypassing whitelist restrictions and accessing closed resources.