CVE-2024-38828: Spring Web MVC DoS Vulnerability in @RequestBody byte[] Parameter
Summary
CVE-2024-38828: Spring MVC controller vulnerable to a DoS attack. Affects org.springframework:spring-webmvc versions >= 5.3.0, < 5.3.42. Fixed in 5.3.42. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2024-38828 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Web MVC is a powerful framework for building web applications in Java. It provides a comprehensive model-view-controller architecture and is widely used for developing RESTful services. However, certain methods in Spring MVC controllers that utilize the @RequestBody annotation with byte[] parameters are susceptible to denial-of-service (DoS) attacks, which can disrupt service availability.
Vulnerability Detail
The vulnerability arises from the handling of byte[] parameters in Spring MVC controller methods. When these parameters are processed without adequate validation or limits on the size of incoming requests, an attacker can exploit this by sending excessively large payloads. This can lead to resource exhaustion on the server, causing it to become unresponsive or crash. The technical implications include potential memory overflow and increased CPU usage, which can severely impact the performance and availability of the application.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.3.42
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement request size limits in your application to prevent excessively large requests from being processed. This can be done by configuring the server settings or adding filters to your application that check the size of incoming requests before they reach the controller methods.
Conclusion
CVE-2024-38828 presents a significant risk to applications using Spring Web MVC with @RequestBody byte[] parameters. It is essential to update to the patched version to safeguard against potential denial-of-service attacks. Implementing request size limits can serve as a temporary measure while preparing for the update.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
CVE-2024-38828 is a vulnerability in Spring Web MVC that allows for denial-of-service attacks through the misuse of @RequestBody byte[] parameters.
If exploited, this vulnerability can lead to resource exhaustion, making your application unresponsive and potentially crashing the server.
Versions prior to 6.0.0 are affected by this vulnerability. It is crucial to upgrade to version 6.0.0 or later to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your pom.xml file on the Vulert playground, you can determine if your application is impacted by this vulnerability.
If an immediate update is not possible, implement request size limits as a workaround to prevent large payloads from being processed.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
