RegexRequestMatcher.matches() allocates LogMessage wrapper on every request even when debug disabled

Assessment

Research direction

Description

Describe the bug
web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java:136 allocates memory and wastes CPU when debug logging is disabled - a typical production scenario.

OrRequestMatcher.matches calls every child matcher per request, so this multiplies by the number of regex rules in the security config.

Proposed fix: wrap with isDebugEnabled()

Stacktrace:

  org.springframework.core.log.LogMessage$FormatMessage2.<init>(String, Object, Object)
  org.springframework.core.log.LogMessage.format(String, Object, Object)
  org.springframework.security.web.util.matcher.RegexRequestMatcher.matches(HttpServletRequest)
  org.springframework.security.web.util.matcher.OrRequestMatcher.matches(HttpServletRequest)
  org.springframework.security.web.DefaultSecurityFilterChain.matches(HttpServletRequest)
  org.springframework.security.web.FilterChainProxy.getFilters(HttpServletRequest)
  org.springframework.security.web.FilterChainProxy.doFilterInternal(ServletRequest, ServletResponse, FilterChain)
  org.springframework.security.web.FilterChainProxy.doFilter(ServletRequest, ServletResponse, FilterChain)

Contributor guide

Open the contributing guide

First steps

1. Read the whole issue, then the project's contributing guide.
2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
3. Fork the repository and make your change on a branch.
4. Open a pull request that references the issue number.

More from spring-projects/spring-security

• IpInetAddressMatcher throws ArrayIndexOutOfBoundsException instead of returning false for mismatched IPv4/IPv6 families Open
  status: waiting-for-triage

  Difficulty 2/5 1-3 hours Newbie friendliness 88/100

  spring-projects/spring-security#19733 · Opened Sep 16, 2026

• [doc issue] filter ordering Open
  status: waiting-for-triage type: enhancement

  Difficulty 2/5 1-3 hours Newbie friendliness 78/100

  spring-projects/spring-security#19730 · Opened Sep 15, 2026

• (doc issue) permitAll/denyAll listed as "methods" in docs but are actually fields in SecurityExpressionRoot Open
  status: waiting-for-triage type: bug

  Difficulty 1/5 Under an hour Newbie friendliness 90/100

  spring-projects/spring-security#19728 · Opened Sep 15, 2026

• XML configuration tests fail with a non-English locale Open
  status: waiting-for-triage type: bug

  Difficulty 2/5 1-3 hours Newbie friendliness 74/100

  spring-projects/spring-security#19725 · Opened Sep 15, 2026

• Dependabot auto-merge should not apply to minor release updates Open
  in: build type: task

  Difficulty 2/5 1-3 hours Newbie friendliness 72/100

  spring-projects/spring-security#19717 · Opened Sep 14, 2026

All issues in spring-projects/spring-security

Similar issues

• Document Hot Rod migration version compatibility for Data Grid 8.6 Open

  Difficulty 2/5 1-3 hours Newbie friendliness 82/100

  infinispan/infinispan#18150 · Opened Sep 21, 2026

• [BUG] Route53Resolver: CreateResolverEndpoint requires IpAddressRequests, but the AWS member is IpAddresses, so no SDK client can call it Open

  Difficulty 2/5 1-3 hours Newbie friendliness 84/100

  floci-io/floci#4108 · Opened Sep 21, 2026

• [BUG] RestGetModelHandlerIT.testGetModel_whenModelIDIsInValid_thenFail depends on test order and fails when run alone Open
  untriaged

  Difficulty 2/5 1-3 hours Newbie friendliness 82/100

  opensearch-project/k-NN#3597 · Opened Sep 21, 2026

• Concurrent builder skips 'verify' phase when running 'mvn install' Open
  bug

  Difficulty 2/5 1-3 hours Newbie friendliness 88/100

  apache/maven#13230 · 1 comment · Opened Sep 21, 2026

• ComponentGeNRTL leaves lnGamma stale after computing gamma Open
  bug

  Difficulty 2/5 1-3 hours Newbie friendliness 82/100

  equinor/neqsim#3899 · 1 comment · Opened Sep 21, 2026

More Java issues