Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreSpring Expression DoS Vulnerability
Description
In Spring Framework, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Affected Spring Products and Versions
Spring Framework:
- 6.0.0 - 6.0.6
- 5.3.0 - 5.3.25
- 5.2.22.RELEASE and earlier
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Fix version | Availability |
|---|---|
| 6.0.7 | OSS |
| 5.3.26 | OSS |
| 5.2.23.RELEASE | OSS |
No further mitigation steps are necessary.
Credit
This vulnerability was initially discovered and responsibly reported by the Google OSS-Fuzz team from Code Intelligence.
References
History
- 2023-03-20: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all