CVE-2023-34055: Spring Boot server Web Observations DoS Vulnerability
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * `org.springframework.boot:spring-boot-actuator` is on the classpath
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-34055?
CVE-2023-34055 is a vulnerability in Spring Boot server Web Observations that allows a user to cause a denial-of-service (DoS) condition.
How does CVE-2023-34055 affect Spring Boot versions?
CVE-2023-34055 affects Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12, and 3.1.0-3.1.5.
What is the severity of CVE-2023-34055?
CVE-2023-34055 has a severity rating of 5.3, which is medium.
How can I fix CVE-2023-34055?
To fix CVE-2023-34055, update Spring Boot to version 3.1.6, 3.0.13, or 2.7.18.
Where can I find more information about CVE-2023-34055?
You can find more information about CVE-2023-34055 at the following references: - [Spring Advisory](https://spring.io/security/cve-2023-34055) - [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-34055) - [GitHub Advisory](https://github.com/advisories/GHSA-jjfh-589g-3hjx)