~ / search / GHSA-558x-2xjg-6232

GHSA-558x-2xjg-6232

Allocation of Resources Without Limits or Throttling in Spring Framework

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-22950

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework:spring-expression >= 5.3.0, < 5.3.17 5.3.17
Maven org.springframework:spring-expression < 5.2.20.RELEASE 5.2.20.RELEASE

Details

As written in the advisory (Markdown source, shown as plain text).

In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0.RELEASE - 5.2.19.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

References

External links from the advisory. They lead to third-party sites.