Executive brief
Spring Framework, a widely used tool for building Java applications, contains a vulnerability in its path-matching component. An attacker could potentially cause the application to slow down or become unresponsive by providing a specially crafted web address pattern. This could lead to a minor disruption in service availability, though it does not allow for data theft or unauthorized access.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the AntPathMatcher component of Spring Framework due to inefficient regular expression complexity (CWE-1333). The issue is triggered when an attacker-controlled pattern is supplied to the match(), matchStart(), or extractUriTemplateVariables() methods. While the attack vector is network-based and requires no privileges, the complexity is considered high as it depends on the application's specific implementation and how it handles user-supplied path patterns. Exploitation can lead to excessive CPU consumption and a partial denial of service. The vulnerability is addressed in Spring Framework versions 7.0.8 and 6.2.19.
Affected products
- Spring Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-07-30: patched