Vulnerability · Published Aug 20, 2024 · Assigned by vmware
CVE-2024-38808CVE-2024-38808: Spring Expression DoS Vulnerability
Medium 4.3
In plain English
A medium-severity resource allocation without limits in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libspring-java | no fix listed | DEBIAN-CVE-2024-38808 |
| Debian:13 | libspring-java | no fix listed | DEBIAN-CVE-2024-38808 |
| Debian:14 | libspring-java | no fix listed | DEBIAN-CVE-2024-38808 |
| Maven | org.springframework:spring-expression | 5.3.39 | GHSA-9cmq-m9j5-mvww |
| Ubuntu:25.10 | libspring-java | no fix listed | UBUNTU-CVE-2024-38808 |
| Ubuntu:26.04:LTS | libspring-java | no fix listed | UBUNTU-CVE-2024-38808 |
| Ubuntu:26.10 | libspring-java | no fix listed | UBUNTU-CVE-2024-38808 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Framework | 5.3.0 – before 5.3.39, 6.0+ |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L