CVE-2026-41848: Spring Framework Denial of Service via AntPathMatcher
Summary
CVE-2026-41848: Spring Framework Denial of Service via AntPathMatcher. Affects org.springframework:spring-core across 4 version ranges.
< 5.3.39
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.19
>= 7.0.0, < 7.0.8
Fixed in 5.3.39, 6.2.19 or 7.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Spring Framework is a powerful framework for building Java applications, providing comprehensive infrastructure support for developing Java applications. It offers features such as dependency injection, aspect-oriented programming, and transaction management. However, certain versions of the Spring Framework are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, particularly through the AntPathMatcher component, which is used for matching URL patterns.
Vulnerability Detail
The vulnerability arises when an attacker can supply a malicious pattern to methods in AntPathMatcher, such as match(String pattern, String path), matchStart(String pattern, String path), or extractUriTemplateVariables(String pattern, String path). This can lead to a Denial of Service (DoS) condition, where the application becomes unresponsive due to excessive resource consumption while processing the malicious pattern. The affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.196.2.19 -
>= 7.0.0, < 7.0.87.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using user-supplied patterns in the AntPathMatcher methods until the application can be updated. Implement input validation to restrict the patterns that can be processed by the application.
Conclusion
In summary, the Spring Framework is vulnerable to a Regular Expression Denial of Service attack through specific methods in AntPathMatcher. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for org.springframework:spring-core →
FAQ
A ReDoS attack exploits the way regular expressions are processed, causing excessive backtracking and resource consumption, which can lead to application unresponsiveness.
The affected versions are Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can also check your application in the Vulert playground without signup at Vulert Scanner.
Update your Spring Framework to a patched version as specified in the 'how to fix' section. Additionally, implement input validation to restrict patterns.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
