What is the CVSS score of EUVD-2026-35336?

EUVD-2026-35336 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Framework are affected by EUVD-2026-35336?

Spring Framework's AntPathMatcher is vulnerable to remote Denial of Service through Regular Expression Denial of Service (ReDoS), affecting versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and…. A patch is available.

How to fix or mitigate EUVD-2026-35336?

24 hours: Inventory all systems running affected Spring Framework versions and categorize by environment and business criticality. 7 days: Deploy patched Spring Framework versions (5.3.49+, 6.1.28+, 6.2.19+, 7.0.8+) from the Spring Security Advisory to non-production systems and validate functionality. 30 days: Complete patching across all production systems and conduct regression testing to ensure no application impacts from the updated AntPathMatcher implementation.

Spring Framework EUVD-2026-35336

| CVE-2026-41848 HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-06-09 vmware

GHSA-659m-px2c-25wj

Denial Of Service Java Spring Framework Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Network-reachable and no auth, but AC:H because exploitation requires the uncommon condition of attacker-controlled pattern input reaching AntPathMatcher; impact is availability-only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 11, 2026 - 15:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 11, 2026 - 15:57 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 11, 2026 - 15:52 vuln.today

cvss_changed

Severity Changed

Jun 11, 2026 - 15:52 NVD

LOW HIGH

CVSS changed

Jun 11, 2026 - 15:52 NVD

3.7 (LOW) 7.5 (HIGH)

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:23 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

416 maven packages depend on org.springframework:spring-core (57 direct, 359 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

AnalysisAI

Denial of service in Spring Framework's AntPathMatcher allows remote unauthenticated attackers to exhaust CPU resources via Regular Expression Denial of Service (ReDoS) when attacker-controlled patterns are passed to match(), matchStart(), or extractUriTemplateVariables(). Affects Spring Framework 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7. No public exploit identified at time of analysis, EPSS is very low (0.01%, 2nd percentile), and SSVC indicates no observed exploitation.

Technical ContextAI

AntPathMatcher is Spring's path-pattern matcher used throughout Spring MVC, WebFlux, and Spring Security for URL routing, security filter chains, and resource resolution. It supports Ant-style wildcards (?, *, **) and URI template variables ({var}), which are internally compiled into Java regular expressions. CWE-1333 (Inefficient Regular Expression Complexity) describes catastrophic backtracking, where certain crafted patterns combined with specific input strings cause exponential matching time. The vulnerability surfaces when application code allows untrusted input to flow into the 'pattern' argument of AntPathMatcher.match(), matchStart(), or extractUriTemplateVariables() - an unusual data flow because patterns are typically developer-defined, but possible in frameworks that build dynamic ACLs, multi-tenant routing rules, or pattern-driven resource lookups from user input. The affected CPE is cpe:2.3:a:spring:spring_framework across all listed branches.

RemediationAI

Vendor-released patch: upgrade Spring Framework to 5.3.49, 6.1.28, 6.2.19, or 7.0.8 depending on the branch in use, per https://spring.io/security/cve-2026-41848. If immediate upgrade is not possible, audit application code for any call path where untrusted input reaches the pattern argument of AntPathMatcher.match(), matchStart(), or extractUriTemplateVariables() and either remove the data flow, validate the input against a strict allow-list of Ant-style metacharacters, or impose a length cap (e.g. 256 characters) before passing it to the matcher; trade-off is that strict input validation may reject legitimate complex patterns in admin UIs. As a runtime control, deploying request timeouts at the servlet container or reverse-proxy layer limits CPU consumption per request but does not prevent thread starvation under concurrent abuse.