Log in Start free

Vulnerability · Published Sep 27, 2024 · Assigned by vmware

CVE-2024-38809

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in Spring Framework. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.9%top 41.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2024-38809
Debian:13libspring-javano fix listedDEBIAN-CVE-2024-38809
Debian:14libspring-javano fix listedDEBIAN-CVE-2024-38809
Mavenorg.springframework:spring-web5.3.38GHSA-2rmj-mq67-h97g
Mavenorg.springframework:spring-web6.0.23GHSA-2rmj-mq67-h97g
Mavenorg.springframework:spring-web6.1.12GHSA-2rmj-mq67-h97g
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2024-38809
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2024-38809
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2024-38809

Affected products (as reported)

VendorProductVersions
N/A Spring Framework 6.1.0 - 6.1.11, 6.0.0 - 6.0.22, 5.3.0 - 5.3.37

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References