~ / search / GHSA-rqph-vqwm-22vc

GHSA-rqph-vqwm-22vc

Allocation of Resources Without Limits or Throttling in Spring Framework

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-22971

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework:spring-messaging >= 5.3.0, < 5.3.20 5.3.20
Maven org.springframework:spring-messaging < 5.2.22.RELEASE 5.2.22.RELEASE

Details

As written in the advisory (Markdown source, shown as plain text).

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

References

External links from the advisory. They lead to third-party sites.