Regular Expression Denial of Service Vulnerability in Spring Framework
CVE-2026-41848

3.7LOW

Key Information:

Vendor

Spring

Status
Spring Framework
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41848?

The Spring Framework contains a vulnerability that exposes applications to Regular Expression Denial of Service (ReDoS) attacks. An attacker can exploit this vulnerability by crafting a specific pattern that is submitted to methods like match(String pattern, String path), matchStart(String pattern, String path), or extractUriTemplateVariables(String pattern, String path) for processing. This can lead to significant performance degradation when the application attempts to process complex regular expressions. It is essential for developers to mitigate exposure by updating to the latest versions and implementing proper input validation.

Affected Version(s)

Spring Framework 7.0.0 < 7.0.7.1

Spring Framework 6.2.0 < 6.2.18.1

Spring Framework 6.1.0 < 6.1.28

References

https://spring.io/security/cve-2026-41848

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.