Denial of Service Vulnerability in libspring-java
Summary
CVE-2024-38808: In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) c... Affects libspring-java versions >= 5acffaa72da10ba42fe547eeea44d8615cbf99b9, < f1b128b88d734670b4e1842e9ecf41f5252c778d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libspring-java is a Java library that provides the Spring Framework, which is a popular open-source application framework for building Java applications. It offers comprehensive programming and configuration models for modern Java-based enterprise applications. The library is widely used in various Debian distributions, including Debian 11, Debian 12, and Debian 13.
Vulnerability Detail
A vulnerability, identified as CVE-2024-38808, has been discovered in libspring-java versions 5.3.0 - 5.3.38 and older unsupported versions. This vulnerability allows an attacker to exploit a flaw in the Spring Expression Language (SpEL) evaluation, leading to a denial of service (DoS) condition. By providing a specially crafted SpEL expression, an attacker can cause the application to consume excessive resources, resulting in a DoS situation. This vulnerability affects applications that evaluate user-supplied SpEL expressions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to a patched version of libspring-java.
Conclusion
libspring-java versions 5.3.0 - 5.3.38 and older unsupported versions are vulnerable to a denial of service (DoS) attack due to a flaw in the Spring Expression Language (SpEL) evaluation. To mitigate this vulnerability, it is recommended to upgrade to a patched version of libspring-java (5.3.39 or later) and validate user-supplied SpEL expressions.
See every vulnerability recorded for libspring-java →
FAQ
libspring-java is a Java library that provides the Spring Framework, an open-source application framework for building Java applications.
This vulnerability allows an attacker to cause a denial of service (DoS) condition in applications that evaluate user-supplied Spring Expression Language (SpEL) expressions.
Versions 5.3.0 - 5.3.38 and older unsupported versions of libspring-java are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to a patched version of libspring-java (version 5.3.39 or later).
No, there is no known workaround for this vulnerability. It is crucial to apply the fix by upgrading to a patched version of libspring-java.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
