GHSA-659m-px2c-25wj CVE-2026-41848
Spring Framework Denial of Service via AntPathMatcher
- Severity
- 3.7 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.34%
- Chance of exploitation in the next 30 days. Higher than 26.90% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
7.0.8- Upgrade org.springframework:spring-core to this version or later
Description
Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.springframework:spring-core | >= 7.0.0, < 7.0.8 |
7.0.8 |
| org.springframework:spring-core | >= 6.2.0, < 6.2.19 |
6.2.19 |
| org.springframework:spring-core | >= 6.1.0, <= 6.1.21 |
No fix yet |
| org.springframework:spring-core | <= 5.3.39 |
No fix yet |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.springframework:spring-core Maven → 7.0.8
- maven
<dependency><groupId>org.springframework</groupId><artifactId>spring-core</artifactId><version>7.0.8</version></dependency>- gradle
implementation("org.springframework:spring-core:7.0.8")
Severity breakdown
CVSS 3.1 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-jmp9-x22r-554x Spring Framework annotation detection mechanism may result in improper authorization | High | Also affects org.springframework:spring-core |
| GHSA-r4q3-7g4q-x89m Spring Framework server Web DoS Vulnerability | High | Also affects org.springframework:spring-core |
| GHSA-rfmp-97jj-h8m6 Improper Output Neutralization for Logs in Spring Framework | Medium | Also affects org.springframework:spring-core |
| GHSA-wv88-pf73-x22p Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework | High | Also affects org.springframework:spring-core |
| GHSA-f866-m9mv-2xr3 Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data | Medium | Also affects org.springframework:spring-core |
| GHSA-rhcg-rwhx-qj3j Improper Limitation of a Pathname to a Restricted Directory in Spring Framework | Medium | Also affects org.springframework:spring-core |
| GHSA-wjjr-h4wh-w6vv Spring Framework Inefficient Regular Expression Complexity | Medium | Also affects org.springframework:spring-core |
| GHSA-6gf2-pvqw-37ph Log entry injection in Spring Framework | Medium | Also affects org.springframework:spring-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor