CVE-2018-15756: Denial of Service in Spring Framework
Summary
CVE-2018-15756: Denial of Service in Spring Framework. Affects org.springframework:spring-core across 3 version ranges.
>= 4.2.0.RELEASE, < 4.3.20.RELEASE
>= 5.0.0.RELEASE, < 5.0.10.RELEASE
>= 5.1.0.RELEASE, < 5.1.1.RELEASE
Fixed in 4.3.20.RELEASE, 5.0.10.RELEASE or 5.1.1.RELEASE, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2018-15756 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The affected package, org.springframework:spring-core, is a core component of the Spring Framework that provides fundamental utilities and abstractions. It is widely used in various Java applications.
Vulnerability Detail
The vulnerability, identified as CVE-2018-15756, affects Spring Framework versions 5.1, 5.0.x (prior to 5.0.10), and 4.3.x (prior to 4.3.20). It arises from the support for range requests when serving static resources through the ResourceHttpRequestHandler or when an annotated controller returns an org.springframework.core.io.Resource. An attacker can exploit this vulnerability by sending a range header with a high number of ranges or wide ranges that overlap. This can lead to a denial of service (DoS) attack. Applications that depend on spring-webmvc or spring-webflux and serve static resources or have an annotated controller returning org.springframework.core.io.Resource are vulnerable. Spring Boot applications using spring-boot-starter-web or spring-boot-starter-webflux are also affected.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2.0.RELEASE, < 4.3.20.RELEASE4.3.20.RELEASE -
>= 5.0.0.RELEASE, < 5.0.10.RELEASE5.0.10.RELEASE -
>= 5.1.0.RELEASE, < 5.1.1.RELEASE5.1.1.RELEASE
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can disable the serving of static resources or remove the annotated controllers that return org.springframework.core.io.Resource. However, this may impact the functionality of the application and is not a recommended long-term solution. It is best to apply the official fix by upgrading the Spring Framework.
Conclusion
The vulnerability in the Spring Framework can lead to a denial of service attack in applications that serve static resources or have annotated controllers returning org.springframework.core.io.Resource. It is crucial for developers to upgrade to the fixed versions and review their applications for any usage of the vulnerable components. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-core →
FAQ
The vulnerability allows an attacker to perform a denial of service attack, potentially causing the affected application to become unresponsive or crash.
Versions 5.1, 5.0.x (prior to 5.0.10), and 4.3.x (prior to 4.3.20) are affected.
Yes, Spring Boot applications using spring-boot-starter-web or spring-boot-starter-webflux are also vulnerable if they serve static resources or have annotated controllers returning org.springframework.core.io.Resource.
Yes, upgrading the Spring Framework to the recommended versions (5.1.1 or higher for 5.1, 5.0.10 or higher for 5.0.x, and 4.3.20 or higher for 4.3.x) resolves the vulnerability.
Developers should upgrade the Spring Framework to the fixed versions, review their applications for usage of the vulnerable components, and ensure they are updated accordingly.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
