CVE-2009-1190

Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.

• CWE-399

• http://secunia.com/advisories/34892Vendor Advisory
• http://www.packetstormsecurity.org/hitb06/DAY_1_-_Marc_Schoenefeld_-_Pentesting_Java_J2EE.pdfExploit
• http://www.securityfocus.com/archive/1/502926/100/0/threaded
• http://www.springsource.com/securityadvisoryVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=497161Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50083
• http://secunia.com/advisories/34892Vendor Advisory
• http://www.packetstormsecurity.org/hitb06/DAY_1_-_Marc_Schoenefeld_-_Pentesting_Java_J2EE.pdfExploit
• http://www.securityfocus.com/archive/1/502926/100/0/threaded
• http://www.springsource.com/securityadvisoryVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=497161Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50083

Published

Apr 27, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1184The selinux_ip_postroute_iptables_compat function in securit…
• CVE-2009-1185udev before 1.4.1 does not verify whether a NETLINK message …
• CVE-2009-1186Buffer overflow in the util_path_encode function in udev/lib…
• CVE-2009-1187Integer overflow in the JBIG2 decoding feature in Poppler be…
• CVE-2009-1188Integer overflow in the JBIG2 decoding feature in the Splash…
• CVE-2009-1189The _dbus_validate_signature_with_reason function (dbus-mars…
• CVE-2009-1191mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HT…
• CVE-2009-1192The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pag…
• CVE-2009-1193Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2009-1194Integer overflow in the pango_glyph_string_set_size function…
• CVE-2009-1195The Apache HTTP Server 2.2.11 and earlier 2.2 versions does …
• CVE-2009-1196The directory-services functionality in the scheduler in CUP…