Spring Framework Denial of Service via AntPathMatcher

🗓️ 09 Jun 2026 06:31:58Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 9 Views

Spring Framework suffers ReDoS via AntPathMatcher.

Reporter	Title	Published	Views	Family All 68
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Framework affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	6 Aug 202620:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service (ReDoS) in Spring Framework [CVE-2026-41848]	27 Jul 202620:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Vulnerable to Regular Expression Denial of Service (ReDoS)	22 Jul 202608:00	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance	10 Aug 202610:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow a Regular Expression Denial of Service (ReDoS) attack	25 Jun 202619:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Aug 202614:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in spring-core jar (CVE-2026-41848)	27 Jul 202607:40	–	ibm
Chainguard	CVE-2026-41848 vulnerabilities	31 Jul 202620:22	–	cgr
CNNVD	VMware Spring Framework 安全漏洞	9 Jun 202600:00	–	cnnvd

Vulners

Node

OR

org.springframework spring-coreRange≤5.3.39maven

org.springframework spring-coreRange6.1.0–6.1.21maven

org.springframework spring-coreRange6.2.0–6.2.18maven

org.springframework spring-coreRange7.0.0–7.0.7maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41848
spring	www.spring.io/security/cve-2026-41848
github	www.github.com/spring-projects/spring-framework/commit/12b44f2545a1bec6150c7a05e66092c732597a94
github	www.github.com/spring-projects/spring-framework/releases/tag/v6.2.19
github	www.github.com/spring-projects/spring-framework/releases/tag/v7.0.8
github	www.github.com/advisories/GHSA-659m-px2c-25wj

30 Jul 2026 18:29Current

7High risk

Vulners AI Score7

CVSS 3.13.7 - 7.5

EPSS0.00317

SSVC

ant path matcher regular expression denial of service spring framework uri template variables