CVE-2009-1190

CVE-2009-1190 describes an algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method within Sun Java Development Kit (JDK) versions prior to 1.6, specifically when integrated with SpringSource Spring Framework versions 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2, and dm Server versions 1.0.0 through 1.0.2. This vulnerability allows remote attackers to trigger a denial of service (CPU consumption) by submitting serializable data containing a lengthy regular expression string with numerous optional groups. The vulnerability has a CVSS score of 5.0, indicating a medium severity, with an attack vector of network, low attack complexity, no authentication required, and a potential impact of partial availability loss. Its EPSS score is very low at 0.01381, suggesting a low probability of exploitation. There is no evidence of active exploitation, nor are there any public exploit modules available in Metasploit, Nuclei, or ExploitDB. The CVE has garnered no community discussion or media coverage, further indicating a lack of widespread attention or exploitation.