org.springframework:spring-messaging

2 results · Clear filters · Feed

• Medium 6.5
  CVE-2022-22971 Public exploit

  Allocation of Resources Without Limits or Throttling in Spring Framework

  In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

  libspring-java libspring-java jenkins org.springframework:spring-messaging Debian Ubuntu Alpine Maven
  May 12, 2022
• Critical 9.8
  CVE-2018-1270 Public exploit EPSS 78%

  Spring Framework allows applications to expose STOMP over WebSocket endpoints

  Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious u…

  Spring by Pivotal Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  Apr 6, 2018