Uncontrolled Resource Consumption ('Resource Exhaustion') Affecting org.springframework:spring-core package, versions [6.0.15,6.0.16) [6.1.2,6.1.3)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORK-6183818
- published 22 Jan 2024
- disclosed 22 Jan 2024
- credit Aleksander Blomskøld
Introduced: 22 Jan 2024
CVE-2024-22233 Open this link in a new tabHow to fix?
Upgrade org.springframework:spring-core to version 6.0.16, 6.1.3 or higher.
Overview
org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.
Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') via specially crafted HTTP requests. An attacker can cause a denial-of-service condition by sending malicious requests that exploit this issue.
Notes:
This is only exploitable if the application uses Spring MVC and Spring Security 6.1.6+ or 6.2.1+ is on the classpath.
Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.