Vulnerability · Published Jan 22, 2024 · Assigned by vmware
CVE-2024-22233CVE-2024-22233: Spring Framework server Web DoS Vulnerability
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC * Spring Security 6.1.6+ or 6.2.1+ is on the classpath Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework:spring-core | 6.1.3 | GHSA-r4q3-7g4q-x89m |
| Maven | org.springframework:spring-core | 6.0.16 | GHSA-r4q3-7g4q-x89m |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Framework | 6.1.26.0.15 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H