Description
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
* the application uses Spring MVC or Spring WebFlux
* org.springframework.boot:spring-boot-actuator is on the classpath
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring Boot | 2.7.0 – < 2.7.18, 3.0.0 – < 3.0.13, 3.1.0 – < 3.1.6, older unsupported versions | 2.7.18 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.boot:spring-boot-actuator | < 2.7.18 | 2.7.18 | GHSA-jjfh-589g-3hjx |
| Maven | org.springframework.boot:spring-boot-actuator | >= 3.0.0, < 3.0.13 | 3.0.13 | GHSA-jjfh-589g-3hjx |
| Maven | org.springframework.boot:spring-boot-actuator | >= 3.1.0, < 3.1.6 | 3.1.6 | GHSA-jjfh-589g-3hjx |
Advisories 11
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2024-0869 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2025
- WID-SEC-2023-3009 VMware Tanzu Spring Framework und Boot: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jun 29, 2025
- NCSC-2024-0416 Kwetsbaarheden verholpen in Oracle Financial Services Applications NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3192 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- NCSC-2024-0297 Kwetsbaarheden verholpen in Oracle Financial Services Applications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1638 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-0870 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 22, 2024
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- WID-SEC-2024-0241 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 29, 2024
- WID-SEC-2024-0106 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024