This vulnerability arises from inefficient handling of regular expressions in the Spring Framework's AntPathMatcher methods: match(String pattern, String path), matchStart(String pattern, String path), and extractUriTemplateVariables(String pattern, String path). An attacker able to supply a malicious pattern could trigger a Regular Expression Denial of Service (ReDoS) attack, potentially causing performance degradation or service disruption. The affected versions span multiple major releases of Spring Framework, from 5.3.0 up to 7.0.7. The CVSS 3.1 base score is 3.7, indicating a low severity impact primarily affecting availability with network attack vector and high attack complexity.

The impact is limited to a potential denial of service condition caused by inefficient regular expression processing. There is no impact on confidentiality or integrity. The low CVSS score reflects that exploitation requires high attack complexity and does not result in data compromise. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure to untrusted input that could be supplied to the affected AntPathMatcher methods. Monitor vendor communications for updates regarding patches or official mitigations.