Find, fix and prevent vulnerabilities in your code.

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the WebDAV LOCK and PROPFIND XML request bodies. An attacker can cause excessive resource consumption by sending specially crafted requests that trigger unbounded reads.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.118, 10.1.55, 11.0.22 or higher.

References

• Apache Mailing List
• GitHub Commit

Overview

org.springframework.security:spring-security-config is a security configuration package for Spring Framework.

Affected versions of this package are vulnerable to Access Control Bypass in the XML authorization rules processing when the servlet-path attribute is used. An attacker can gain unauthorized access to protected endpoints by crafting requests that bypass intended authorization checks.

Remediation

Upgrade org.springframework.security:spring-security-config to version 7.0.5 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework.security:spring-security-config is a security configuration package for Spring Framework.

Affected versions of this package are vulnerable to Access Control Bypass in the securityMatchers component when a PathPatternRequestMatcher.Builder bean is used to prepend a servlet path. An attacker can bypass authentication, authorization, and other security controls by crafting requests that are not properly matched to the intended filter chain.

Remediation

Upgrade org.springframework.security:spring-security-config to version 7.0.5 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Authentication in processOCSPRequest(), which is part of the the CLIENT_CERT authentication process. In some "edge cases", an attacker can trigger a soft-fail of OCSP checks when soft-fail is disabled.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.117, 10.1.54, 11.0.21 or higher.

References

• Apache Mailing List
• GitHub Commit
• OSS Security Advisory

Overview

Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) for the property source for ${random.value} (as well as ${random.int} and ${random.long}). Standard PRNGs (like java.util.Random) use deterministic mathematical algorithms starting from a seed value. Because the state space is relatively small and lacks ongoing entropy (true randomness), an attacker who observes a sequence of generated values can mathematically reverse-engineer the seed. Once the seed is known, the attacker can predict all past and future values generated by that PRNG. If these values are used to generate security-sensitive assets like API keys, session tokens, or passwords, the system becomes compromised.

Remediation

Upgrade org.springframework.boot:spring-boot to version 3.5.14, 4.0.6 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Timing Attack in DevTool due to comparing the user-provided "remote secret" against the actual secret using standard string comparison logic (like String.equals() or ==). Standard string comparisons are not constant-time. They evaluate character by character and exit immediately (return false) as soon as they find the first mismatch. Because the comparison stops early upon a mismatch, it takes slightly longer to reject a guess that gets the first few characters correct than a guess that is completely wrong. An attacker on the same network can measure these microsecond differences to deduce the secret character by character.

Remediation

Upgrade org.springframework.boot:spring-boot-devtools to version 3.5.14, 4.0.6 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Insecure Temporary File due to the ApplicationTemp mechanism creating a temporary directory using a predictable name. Because the name can be easily guessed, a local attacker on the same server can maliciously pre-create this directory before the Spring Boot application starts. When the application launches, it would blindly use the existing directory without verifying if it is actually owned by the application's user or the attacker.

Remediation

Upgrade org.springframework.boot:spring-boot to version 3.5.14, 4.0.6 or higher.

References

• GitHub Commit
• Spring Security Advisory