CVE-2026-41848: Spring Framework Denial of Service via AntPathMatcher
Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path). Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41848?
The severity of CVE-2026-41848 is classified as low with a score of 3.7.
How can I mitigate CVE-2026-41848?
To mitigate CVE-2026-41848, ensure that patterns provided to AntPathMatcher methods are validated or sanitized before use.
What impact does CVE-2026-41848 have on applications?
CVE-2026-41848 may lead to a Denial of Service (DoS) if an attacker exploits the vulnerability through specially crafted patterns.
Which software is affected by CVE-2026-41848?
CVE-2026-41848 affects applications using the VMware Spring Framework.
When was CVE-2026-41848 published?
CVE-2026-41848 was published on June 9, 2026.