~ / search / GHSA-2rmj-mq67-h97g

GHSA-2rmj-mq67-h97g

Spring Framework DoS via conditional HTTP request

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-38809

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework:spring-web < 5.3.38 5.3.38
Maven org.springframework:spring-web >= 6.0.0, < 6.0.23 6.0.23
Maven org.springframework:spring-web >= 6.1.0, < 6.1.12 6.1.12

Details

As written in the advisory (Markdown source, shown as plain text).

### Description Applications that parse ETags from `If-Match` or `If-None-Match` request headers are vulnerable to DoS attack. ### Affected Spring Products and Versions org.springframework:spring-web in versions 6.1.0 through 6.1.11 6.0.0 through 6.0.22 5.3.0 through 5.3.37 Older, unsupported versions are also affected ### Mitigation Users of affected versions should upgrade to the corresponding fixed version. 6.1.x -> 6.1.12 6.0.x -> 6.0.23 5.3.x -> 5.3.38 No other mitigation steps are necessary. Users of older, unsupported versions could enforce a size limit on `If-Match` and `If-None-Match` headers, e.g. through a Filter.

References

External links from the advisory. They lead to third-party sites.