CVE-2024-38808: Spring Expression DoS Vulnerability
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
The application evaluates user-supplied SpEL expressions.
Other sources
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.
Specifically, an application is vulnerable when the following is true:
The application evaluates user-supplied SpEL expressions.
— GitHub
VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted Spring Expression Language (SpEL) expression, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38808?
CVE-2024-38808 has a severity rating that indicates it may lead to denial of service (DoS) conditions in affected applications.
How do I fix CVE-2024-38808?
To fix CVE-2024-38808, you should upgrade to Spring Framework version 5.3.39 or newer.
Which Spring Framework versions are affected by CVE-2024-38808?
CVE-2024-38808 affects Spring Framework versions 5.3.0 through 5.3.38.
Who is impacted by CVE-2024-38808?
Users of the Spring Framework versions 5.3.0 - 5.3.38 and certain IBM products are impacted by CVE-2024-38808.
What type of vulnerability is CVE-2024-38808?
CVE-2024-38808 is a denial of service (DoS) vulnerability related to the processing of Spring Expression Language (SpEL) expressions.