Description

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.

Affected Spring Products and Versions

Spring Framework

• 6.1.0 - 6.1.11
• 6.0.0 - 6.0.22
• 5.3.0 - 5.3.37
• Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No other mitigation steps are necessary.

Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.

Credit

This issue was responsibly reported by Seokchan Yoon.

History

• 2024-08-14: Initial vulnerability report published.