CVE-2024-22233: Spring Framework server Web DoS Vulnerability in org.springframework:spring-core
Summary
CVE-2024-22233: Spring Framework server Web DoS Vulnerability. Affects org.springframework:spring-core across 2 version ranges.
>= 6.0.15, < 6.0.16
>= 6.1.2, < 6.1.3
Fixed in 6.0.16 or 6.1.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.springframework:spring-core package is a core component of the Spring Framework, which is a popular open-source application framework for Java. It provides essential functionality for developing Java applications, including dependency injection, data access, and web development. The vulnerability affects versions 6.0.15 and 6.1.2 of the package.
Vulnerability Detail
The vulnerability allows an attacker to launch a denial-of-service (DoS) attack on an application that uses Spring MVC and has Spring Security 6.1.6+ or 6.2.1+ on the classpath. By sending specially crafted HTTP requests, the attacker can trigger a DoS condition, potentially disrupting the availability of the application. Spring Boot applications that have the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies are particularly susceptible to this vulnerability.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.15, < 6.0.166.0.16 -
>= 6.1.2, < 6.1.36.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the org.springframework:spring-core package and ensuring the correct Spring Security version.
Conclusion
The Spring Framework server Web DoS vulnerability in the org.springframework:spring-core package can lead to a denial-of-service attack on affected applications. It is crucial to upgrade to version 6.1.2 or higher of the package and ensure the correct Spring Security version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-core →
FAQ
The vulnerability allows an attacker to launch a DoS attack on an application, potentially causing service disruptions and impacting availability.
Versions 6.0.15 and 6.1.2 of the package are affected.
Yes, Spring Boot applications that have the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies are particularly susceptible.
No, there is currently no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the org.springframework:spring-core package and ensuring the correct Spring Security version.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-core.
