Is CVE-2026-41848 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41848 being exploited in the wild.

How severe is CVE-2026-41848?

Low severity, with a CVSS score of 3.7, published 9 June 2026.

Which products and versions are affected?

org.springframework:spring-core (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Is there a fix for CVE-2026-41848?

Yes. org.springframework:spring-core (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41848 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41848?

Check whether you run org.springframework:spring-core (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41848: VMware Spring Framework ReDoS in AntPathMatcher

CVE-2026-41848 · Severity: low · CVSS 3.7 · Published 2026-06-09

Spring Framework, a widely used tool for building Java applications, contains a vulnerability in its path-matching component. An attacker could potentially cause the application to slow down or become unresponsive by providing a specially crafted web address pattern. This could lead to a minor disruption in service availability, though it does not allow for data theft or unauthorized access.

Technologies: org.springframework:spring-core (Maven), VMware Spring Framework. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41848 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41848 being exploited in the wild.
How severe is CVE-2026-41848?: Low severity, with a CVSS score of 3.7, published 9 June 2026.
Which products and versions are affected?: org.springframework:spring-core (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Is there a fix for CVE-2026-41848?: Yes. org.springframework:spring-core (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41848 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41848?: Check whether you run org.springframework:spring-core (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework:spring-core (Maven): upgrade to 7.0.8 or later

# set org.springframework:spring-core to 7.0.8 in your pom.xml or build.gradle

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the AntPathMatcher component of Spring Framework due to inefficient regular expression complexity (CWE-1333). The issue is triggered when an attacker-controlled pattern is supplied to the match(), matchStart(), or extractUriTemplateVariables() methods. While the attack vector is network-based and requires no privileges, the complexity is considered high as it depends on the application's specific implementation and how it handles user-supplied path patterns. Exploitation can lead to excessive CPU consumption and a partial denial of service. The vulnerability is addressed in Spring Framework versions 7.0.8 and 6.2.19.

Affected products

Spring Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48

Identifiers

CVE-2026-41848
GHSA-659m-px2c-25wj

Timeline

2026-06-09: disclosed
2026-06-09: advisory
2026-07-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.