Medium · 6.5 CVE-2018-1257 EUVD-2018-0682GHSA-rcpf-vj53-7h2m

Denial of Service in org.springframework:spring-core

Published May 11, 2018 · Updated Oct 8, 2026 · Assigned by dell

Vendor: Pivotal Product: Spring Framework Package: libspring-java Package: libspring-java Package: org.springframework:spring-core Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

Affected products

Vendor	Product	Affected	Fixed
Pivotal	Spring Framework	5.0.x prior to 5.0.6; 4.3.x prior to 4.3.17	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libspring-java	4.3.19-1	—
Debian 13	libspring-java	4.3.19-1	—
Debian 12	libspring-java	4.3.19-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	libspring-java	No fix yet	—
Ubuntu Pro 14.04 LTS	libspring-java	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.springframework:spring-core	>= 5.0.0, < 5.0.6	5.0.6	GHSA-rcpf-vj53-7h2m
Maven	org.springframework:spring-core	< 4.3.17	4.3.17	GHSA-rcpf-vj53-7h2m

Advisories 3

WID-SEC-2025-1660 Oracle Utilities: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 28, 2025
WID-SEC-2025-1212 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 2, 2025
WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024

References