Denial of Service Vulnerability in Spring Framework's Resource Handling
Summary
CVE-2018-15756: Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through t... Affects libspring-java across 2 version ranges.
< 4.3.21-1
>= 22a14c02c2fad2f7338bb66a759f325f17089612, < 810fd123d5fd52fccc2aa688573c4d0dd2b5236e
Fixed in 4.3.21-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, providing comprehensive infrastructure support for developing Java applications. It offers features such as dependency injection, aspect-oriented programming, and support for web applications through Spring MVC and Spring WebFlux. However, certain versions of the Spring Framework, specifically 5.1, 5.0.x prior to 5.0.10, and 4.3.x prior to 4.3.20, have a vulnerability related to how they handle range requests for static resources, making them susceptible to denial of service attacks.
Vulnerability Detail
The vulnerability arises from the way the Spring Framework processes range requests for static resources. An attacker can exploit this by sending a range header with a large number of ranges or overlapping ranges, which can overwhelm the server and lead to a denial of service. This affects applications that utilize spring-webmvc or spring-webflux and serve static resources, making them vulnerable to resource exhaustion.
How To Fix
Minimum fixed version
4.3.21-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on your server to mitigate the impact of potential denial of service attacks. This can be done by configuring your web server or application server to limit the number of requests from a single IP address over a specified time period.
Conclusion
The CVE-2018-15756 vulnerability in the Spring Framework poses a significant risk of denial of service attacks due to improper handling of range requests for static resources. It is crucial for developers using affected versions to upgrade to secure versions or implement workarounds to mitigate potential risks.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2018-15756 is a vulnerability in the Spring Framework that allows attackers to perform denial of service attacks by exploiting the handling of range requests for static resources.
Affected versions include Spring Framework 5.1, 5.0.x prior to 5.0.10, and 4.3.x prior to 4.3.20.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If an immediate upgrade is not possible, consider implementing rate limiting as a workaround to reduce the risk of denial of service attacks.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
