CVE-2024-22233
published 2024-01-22CVE-2024-22233: In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS)…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.05%
60.4th percentile
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC * Spring Security 6.1.6+ or 6.2.1+ is on the classpath Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libspring-java | — | — |
| spring | spring_framework | — | — |
| spring | spring_framework | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa5.3MEDIUM
vendor_debian7.5LOW
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Risk Matrix: Third Party (Spring Framework) — CVE-2024-22233
vendor_oracle·2024-04-15·CVSS 7.5
CVE-2024-22233 [HIGH] Oracle Oracle Communications Risk Matrix: Third Party (Spring Framework) — CVE-2024-22233
Oracle Oracle Communications Risk Matrix: Third Party (Spring Framework) vulnerability
CVE: CVE-2024-22233
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Red Hat
spring-boot: Crafted HTTP requests may lead to debial-of-service (DOS)
vendor_redhat·2024-01-22·CVSS 7.5
CVE-2024-22233 [HIGH] CWE-400 spring-boot: Crafted HTTP requests may lead to debial-of-service (DOS)
spring-boot: Crafted HTTP requests may lead to debial-of-service (DOS)
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
* the application uses Spring MVC
* Spring Security 6.1.6+ or 6.2.1+ is on the classpath
Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
A flaw was found in the Spring Framework. This issue may allow a remote user to provide specially crafted HTTP requests, leading the application to a Denial of Service (DoS). An application may be consi
Debian
CVE-2024-22233: libspring-java - In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to prov...
vendor_debian·2024·CVSS 7.5
CVE-2024-22233 [HIGH] CVE-2024-22233: libspring-java - In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to prov...
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC * Spring Security 6.1.6+ or 6.2.1+ is on the classpath Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
Spring Framework DataBinder Case Sensitive Match Exception
ghsa·2025-05-16·CVSS 5.3
CVE-2025-22233 [LOW] CWE-20 Spring Framework DataBinder Case Sensitive Match Exception
Spring Framework DataBinder Case Sensitive Match Exception
CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.
Affected Spring Products and Versions
Spring Framework:
* 6.2.0 - 6.2.6
* 6.1.0 - 6.1.19
* 6.0.0 - 6.0.27
* 5.3.0 - 5.3.42
* Older, unsupported versions are also affected
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix Version | Availability |
| - | - | - |
| 6.2.x | 6.2.7 | OSS |
| 6.1.x | 6.1.20 | OSS |
| 6.0.x | 6.0.28 | Commercial https://enterprise.spring.io/ |
| 5.3.x | 5.3.43 | Commercial https://enterprise.spring
OSV
Spring Framework server Web DoS Vulnerability
osv·2024-01-22
CVE-2024-22233 [HIGH] Spring Framework server Web DoS Vulnerability
Spring Framework server Web DoS Vulnerability
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
* the application uses Spring MVC
* Spring Security 6.1.6+ or 6.2.1+ is on the classpath
Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
GHSA
Spring Framework server Web DoS Vulnerability
ghsa·2024-01-22
CVE-2024-22233 [HIGH] CWE-400 Spring Framework server Web DoS Vulnerability
Spring Framework server Web DoS Vulnerability
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
* the application uses Spring MVC
* Spring Security 6.1.6+ or 6.2.1+ is on the classpath
Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
No detection rules found.
No public exploits indexed.
2024-01-22
Published