Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreSpring Framework server Web DoS Vulnerability
Description
In Spring Framework, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC
- Spring Security 6.1.6+ or 6.2.1+ is on the classpath
Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
Affected Spring Products and Versions
Spring Framework:
- 6.1.2 - 6.1.2
- 6.0.15 - 6.0.15
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Fix version | Availability |
|---|---|
| 6.1.3 | OSS |
| 6.0.16 | OSS |
No further mitigation steps are necessary.
Credit
The issue was identified and responsibly reported by
- Aleksander Blomskøld
- LiveOverflow (hextree.io), ZetaTwo, anasbekar, zzgoon, 0xLegacyy, xyzeva, AcroTiger
History
- 2024-01-22: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all