CVE-2024-38828: Spring Web MVC DoS Vulnerability in @RequestBody byte[] Parameter
Summary
CVE-2024-38828: Spring MVC controller vulnerable to a DoS attack. Affects org.springframework:spring-webmvc versions < 6.0.0. Fixed in 6.0.0. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2024-38828 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Web MVC is a powerful framework that provides a comprehensive model-view-controller architecture for building web applications in Java. It allows developers to create flexible and maintainable applications by separating the different aspects of the application. However, certain methods within Spring MVC controllers that utilize the @RequestBody annotation with byte[] parameters have been identified as vulnerable to denial-of-service (DoS) attacks, which can compromise the availability of the application.
Vulnerability Detail
The vulnerability arises from the handling of byte[] parameters in Spring MVC controller methods annotated with @RequestBody. An attacker can exploit this by sending specially crafted requests that consume excessive resources, leading to a denial of service. This can result in the application becoming unresponsive, affecting legitimate users and potentially leading to significant downtime. The vulnerability has been assigned a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider validating the size of the incoming byte[] data in your controller methods to prevent excessively large payloads from being processed. For example:
@RequestMapping(value = "/upload", method = RequestMethod.POST) public ResponseEntity<String> upload(@RequestBody byte[] data) {
if (data.length > MAX_SIZE) {
return ResponseEntity.badRequest().body("Payload too large");
}
// Process data
return ResponseEntity.ok("Upload successful");
}
Conclusion
CVE-2024-38828 represents a significant vulnerability in Spring Web MVC that can lead to denial-of-service attacks. It is crucial for developers using this framework to update to the patched version 6.0.0 or later to ensure the security and availability of their applications. Implementing input validation can serve as a temporary measure while preparing for the update.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
CVE-2024-38828 is a vulnerability in Spring Web MVC that allows for denial-of-service attacks through the misuse of @RequestBody byte[] parameters in controller methods.
You can check if your application is affected by using Vulert, which monitors your pom.xml for vulnerabilities. Visit Vulert Scanner to test your application without signing up.
Exploitation of this vulnerability can lead to application downtime, making it unavailable to legitimate users, which can result in loss of revenue and trust.
Yes, the vulnerability has been patched in Spring Web MVC version 6.0.0. It is recommended to update to this version or later.
If immediate updating is not possible, implement input validation in your controller methods to limit the size of incoming byte[] data as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
