CVE-2026-41848 describes a vulnerability in the Spring Framework's AntPathMatcher where inefficient regular expression complexity can lead to a denial of service condition. Specifically, if an attacker can provide a pattern to the methods match(String pattern, String path), matchStart(String pattern, String path), or extractUriTemplateVariables(String pattern, String path), the application may experience excessive processing time due to the complexity of the regex evaluation. This affects multiple Spring Framework versions: 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. The vulnerability has a low CVSS score of 3.7, reflecting a low impact on confidentiality, integrity, and a limited impact on availability. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

The impact is limited to a potential denial of service via resource exhaustion caused by inefficient regular expression evaluation in the affected AntPathMatcher methods. There is no impact on confidentiality or integrity. The low CVSS score (3.7) reflects this limited impact. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or validating input patterns supplied to AntPathMatcher methods to reduce the risk of ReDoS. Monitor vendor communications for updates on patches or official mitigations.