CVE-2026-41848
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Applications using AntPathMatcher in Spring Framework are vulnerable to ReDoS if an attacker can supply a pattern to match(), matchStart(), or extractUriTemplateVariables(). Affects Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.
Risk Assessment
The organization may experience denial of service in Spring applications if an attacker can supply a malicious regex pattern, potentially leading to server overload.
Recommendation
Upgrade Spring Framework to version 7.0.8, 6.2.19, 6.1.28, or 5.3.49 (or later). Also restrict the ability for untrusted users to supply regex patterns.
Original NVD description (English source)
Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path). Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.