~ / search / GHSA-hh26-6xwr-ggv7

GHSA-hh26-6xwr-ggv7

Denial of service in Spring Framework

Source: GitHub Advisory Database (reviewed) High CVE-2022-22970

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework:spring-beans < 5.2.22.RELEASE 5.2.22.RELEASE
Maven org.springframework:spring-beans >= 5.3.0, < 5.3.20 5.3.20

Details

As written in the advisory (Markdown source, shown as plain text).

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

References

External links from the advisory. They lead to third-party sites.