Vulnerability Description
Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path). Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Framework | >= 5.3.0, < 5.3.49 |
Related Weaknesses (CWE)
References
- https://spring.io/security/cve-2026-41848Vendor Advisory
FAQ
What is CVE-2026-41848?
CVE-2026-41848 is a vulnerability with a CVSS score of 3.7 (LOW). Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the followin...
How severe is CVE-2026-41848?
CVE-2026-41848 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41848?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Spring Framework.