CVE-2024-38808

Description

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.

Reserved 2024-06-19 | Published 2024-08-20 | Updated 2024-10-30 | Assigner vmware

Product status

Default status
affected

5.3.0 before 5.3.39, 6.0+
affected

References

spring.io/security/cve-2024-38808

cve.org (CVE-2024-38808)

nvd.nist.gov (CVE-2024-38808)

Download JSON