CVE-2026-41848

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48

Description Applications are susceptible to a Regular Expression Denial of Service (ReDoS) attack, which occurs when a specially crafted regular expression causes the processing engine to take an exponential amount of time to complete. This happens when an attacker provides a pattern that is supplied to the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), and extractUriTemplateVariables(String pattern, String path).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.