CVE-2026-41848: Spring Framework AntPathMatcher ReDoS Vulnerability

Technical summary

The vulnerability exists in Spring Framework's AntPathMatcher class, specifically in three methods: match(), matchStart(), and extractUriTemplateVariables(). These methods process user-supplied or attacker-controlled patterns without adequate safeguards against algorithmic complexity attacks. The underlying regular expression engine can enter pathological backtracking behavior when presented with specially crafted input, consuming CPU resources in a way that grows exponentially with input length. The issue is classified as CWE-1333 (Inefficient Regular Expression Complexity).

Business impact

Affected Spring Framework deployments face potential availability degradation if attackers exploit this ReDoS vector. Applications that expose user-controlled path patterns—such as those accepting dynamic URL templates via APIs or configuration—are at higher risk. While the CVSS score of 3.7 reflects a low severity rating, successful exploitation could trigger resource exhaustion on a per-request basis, making the vulnerability operationally relevant in high-traffic environments or scenarios where request volume can be amplified.

Affected systems

VMware Spring Framework versions 7.0.0–7.0.7, 6.2.0–6.2.18, 6.1.0–6.1.27, and 5.3.0–5.3.48 are affected. Organizations should prioritize inventory of Spring Framework usage across their application portfolio. Notably, version 5.3.x, while no longer in mainstream support, remains in extended support; organizations using older branches should confirm their support status with VMware.

Exploitability

Exploitation requires an attacker to supply a crafted pattern to one of the vulnerable methods. The access vector is network-based with no authentication required, but the attack complexity is rated as high, meaning the attacker must understand the specific regex engine behavior and potentially the application's pattern-matching logic. This is not a trivial or widely automated attack; it requires targeted knowledge and is unlikely to appear in commodity exploit kits. No public exploit code or KEV designation indicates active, widespread exploitation as of the publication date.

Remediation

Upgrade to patched versions from VMware's security advisories. The recommended approach is to move to the latest supported version in each release line (verify exact patch versions in the official VMware Spring Framework security bulletins). Organizations unable to upgrade immediately should implement input validation and sanitization on any externally sourced path patterns, restricting pattern complexity and length where feasible.

Patch guidance

Consult VMware's official Spring Framework security advisory for precise patch version numbers and upgrade paths. Generally, upgrading to the latest stable release in your currently supported version line (7.0.8+, 6.2.19+, 6.1.28+, or 5.3.49+, pending verification) is the standard remediation. If you are on an older or unsupported branch, prioritize a version upgrade strategy. Test patches in a non-production environment first, particularly if the application relies heavily on AntPathMatcher for routing or template variable extraction.

Detection guidance

Monitor application logs for unusual patterns in request URIs, particularly those containing repetitive structures or excessive special characters that might trigger backtracking. CPU and memory profiling during normal operations provides a baseline; spikes coinciding with specific request patterns may indicate an attack. Intrusion detection systems capable of detecting regex-based DoS signatures can be tuned to flag suspicious path patterns. Additionally, rate-limit or throttle requests with excessively complex or long path segments.

Why prioritize this

Despite the low CVSS score, this vulnerability merits timely attention because it affects multiple widely-used versions of Spring Framework and can be triggered without authentication or user interaction. However, the high attack complexity and lack of active exploitation reduce urgency compared to critical or high-severity flaws. Prioritize remediation for internet-facing Spring applications that accept dynamic URL patterns; internal or tightly controlled deployments can follow a standard patch cadence.

Risk score, explained

The CVSS v3.1 score of 3.7 (LOW) reflects the absence of confidentiality or integrity impact and the requirement for attacker expertise to craft a successful payload. The network-based attack vector and lack of privilege requirements are partially offset by high attack complexity. The availability impact is limited in scope—denial affects performance rather than complete service outage—further justifying the low rating. Organizations should not dismiss the vulnerability but should allocate resources proportionally.

Frequently asked questions