UBUNTU-CVE-2026-41848

🗓️ 09 Jun 2026 05:16:00Reported by GoogleType

osv🔗 osv.dev👁 28 Views

Spring Framework is vulnerable to a Regular Expression Denial of Service in AntPathMatcher when a crafted pattern is supplied; affected versions 5.3.0–5.3.48, 6.1.0–6.1.27, 6.2.0–6.2.18, 7.0.0–7.0.7.

Reporter	Title	Published	Views	Family All 151
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Framework affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	6 Aug 202620:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service (ReDoS) in Spring Framework [CVE-2026-41848]	27 Jul 202620:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Vulnerable to Regular Expression Denial of Service (ReDoS)	22 Jul 202608:00	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance	10 Aug 202610:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow a Regular Expression Denial of Service (ReDoS) attack	25 Jun 202619:37	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in spring-core-5.3.25.jar and spring-expression-6.1.11.jar (CVE-2026-41850, CVE-2026-41851, CVE-2026-41852, CVE-2026-41848) affect IBM PowerVM Novalink.	28 Aug 202615:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods API Management	28 Aug 202604:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Aug 202614:48	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)	8 Sep 202615:03	–	ibm

Source	Link
ubuntu	www.ubuntu.com/security/CVE-2026-41848
cve	www.cve.org/CVERecord
spring	www.spring.io/security/cve-2026-41848

12 Jun 2026 21:30Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.5

EPSS0.00317