~ / search / GHSA-564r-hj7v-mcr5

GHSA-564r-hj7v-mcr5

Spring Framework vulnerable to denial of service via specially crafted SpEL expression

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-20861

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework:spring-expression >= 6.0.0, < 6.0.7 6.0.7
Maven org.springframework:spring-expression >= 5.3.0, < 5.3.26 5.3.26
Maven org.springframework:spring-expression < 5.2.23.RELEASE 5.2.23.RELEASE

Details

As written in the advisory (Markdown source, shown as plain text).

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

References

External links from the advisory. They lead to third-party sites.