CVE-2024-38809: Input Validation
Description Applications that parse ETags from If-Match or If-None-Match request headers are vulnerable to DoS attack.
Affected Spring Products and Versions org.springframework:spring-web in versions
6.1.0 through 6.1.11 6.0.0 through 6.0.22 5.3.0 through 5.3.37
Older, unsupported versions are also affected
Mitigation Users of affected versions should upgrade to the corresponding fixed version. 6.1.x -> 6.1.12 6.0.x -> 6.0.23 5.3.x -> 5.3.38 No other mitigation steps are necessary.
Users of older, unsupported versions could enforce a size limit on If-Match and If-None-Match headers, e.g. through a Filter.
Other sources
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.
Users of affected versions should upgrade to the corresponding fixed version.
Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
— NVD
VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted HTTP request containing ETags from "If-Match" or "If-None-Match" request headers, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38809?
CVE-2024-38809 is classified as a Denial of Service (DoS) vulnerability.
How do I fix CVE-2024-38809?
To fix CVE-2024-38809, update the org.springframework:spring-web package to version 6.1.12, 6.0.23, or 5.3.38, based on your version.
What applications are affected by CVE-2024-38809?
CVE-2024-38809 affects applications that use org.springframework:spring-web versions 5.3.0 through 5.3.37, 6.0.0 through 6.0.22, and 6.1.0 through 6.1.11.
Can I still use versions of spring-web affected by CVE-2024-38809?
Using affected versions of spring-web poses a security risk and is not recommended until they are updated to a secure version.
What types of attacks can CVE-2024-38809 be exploited for?
CVE-2024-38809 can be exploited to execute Denial of Service (DoS) attacks against vulnerable applications by malformed ETags.