CVE-2024-38829: Spring LDAP Data Exposure Vulnerability
Summary
CVE-2024-38829: Spring LDAP data exposure vulnerability. Affects org.springframework.ldap:spring-ldap-core across 2 version ranges.
< 2.4.4
>= 3.0.0, < 3.2.8
Fixed in 2.4.4 or 3.2.8, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2024-38829 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring LDAP is a framework that provides support for LDAP (Lightweight Directory Access Protocol) in Java applications. It simplifies the interaction with LDAP servers, allowing developers to perform operations such as searching, adding, and modifying entries in an LDAP directory. The framework is widely used in enterprise applications for authentication and directory services. However, certain versions of Spring LDAP are vulnerable to a data exposure issue due to improper handling of case-sensitive comparisons, which can lead to unintended data being queried.
Vulnerability Detail
The vulnerability arises from the use of String.toLowerCase() and String.toUpperCase() methods in Spring LDAP, which can behave differently based on the locale settings of the environment. This can result in unintended columns being queried, potentially exposing sensitive data. The affected versions include Spring LDAP from 2.4.0 through 2.4.3, 3.0.0 through 3.0.9, 3.1.0 through 3.1.7, 3.2.0 through 3.2.7, and all versions prior to 2.4.0. The severity of this vulnerability is classified as moderate, with a CVSS score of 3.7.
How To Fix
Latest published version: 4.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4 -
>= 3.0.0, < 3.2.83.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a workaround by carefully reviewing and modifying the code that handles LDAP queries to avoid using String.toLowerCase() and String.toUpperCase() methods. Instead, use locale-independent comparison methods or ensure that the queries are constructed in a way that does not rely on case sensitivity.
Conclusion
The Spring LDAP data exposure vulnerability (CVE-2024-38829) poses a moderate risk to applications using affected versions of the library. It is crucial to update to the patched versions to mitigate the risk of unauthorized data exposure. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for org.springframework.ldap:spring-ldap-core →
FAQ
The vulnerability can lead to unintended data exposure, allowing unauthorized access to sensitive information stored in the LDAP directory.
The affected versions include Spring LDAP from 2.4.0 through 2.4.3, 3.0.0 through 3.0.9, 3.1.0 through 3.1.7, 3.2.0 through 3.2.7, and all versions prior to 2.4.0.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By simply analyzing your pom.xml file, Vulert can help you identify if your application is affected by this vulnerability.
If you cannot upgrade immediately, consider implementing a workaround by modifying your LDAP query handling to avoid locale-dependent string comparisons.
More information can be found in the official Spring security advisory related to CVE-2024-38820 at https://spring.io/security/cve-2024-38820.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.ldap:spring-ldap-core.
