CVE-2023-34053: Spring Framework Denial of Service Vulnerability
Summary
CVE-2023-34053: Spring Framework vulnerable to denial of service. Affects org.springframework:spring-webmvc versions >= 6.0.0, < 6.0.14. Fixed in 6.0.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The affected package, org.springframework:spring-webmvc, is a module within the Spring Framework that focuses on web development using the Model-View-Controller (MVC) architectural pattern. This vulnerability affects versions 6.0.0 to 6.0.13 of the Spring Framework.
Vulnerability Detail
The vulnerability allows an attacker to trigger a denial-of-service (DoS) condition in applications that use Spring MVC or Spring WebFlux. By sending specially crafted HTTP requests, an attacker can exploit this vulnerability. To be vulnerable, the application must also have the io.micrometer:micrometer-core library on its classpath and have an ObservationRegistry configured to record observations. Spring Boot applications may require the org.springframework.boot:spring-boot-actuator dependency to meet all conditions. The impact of this vulnerability is a potential DoS, which can disrupt the availability of the affected application.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the Spring Framework is not immediately feasible, a possible workaround is to remove the io.micrometer:micrometer-core library from the classpath or disable the ObservationRegistry configuration. However, this may impact the application's ability to collect and record observations using Micrometer.
Conclusion
In conclusion, the Spring Framework versions 6.0.0 to 6.0.13 are vulnerable to a denial-of-service (DoS) attack. It is recommended to upgrade to version 6.0.14 or later to mitigate this vulnerability. If immediate upgrade is not possible, removing the io.micrometer:micrometer-core library or disabling the ObservationRegistry configuration can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
The Spring Framework is an open-source application framework for Java that provides infrastructure support for developing Java applications.
Versions 6.0.0 to 6.0.13 of the Spring Framework are affected.
The vulnerability can lead to a denial-of-service (DoS) condition, potentially disrupting the availability of the affected application.
To fix this vulnerability, upgrade the Spring Framework to version 6.0.14 or later by updating the dependency in your project's build configuration file.
A possible workaround is to remove the io.micrometer:micrometer-core library from the classpath or disable the ObservationRegistry configuration, but this may impact observation recording using Micrometer.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
