GHSA-9cmq-m9j5-mvwwMediumCVSS 4.3

Spring Framework vulnerable to Denial of Service

Published
August 20, 2024
Last Modified
June 18, 2025

🔗 CVE IDs covered (1)

CVE-2024-38808 →

📋 Description

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.

Specifically, an application is vulnerable when the following is true:

  • The application evaluates user-supplied SpEL expressions.

🎯 Affected products1

  • maven/org.springframework:spring-expression:< 5.3.39

🔗 References (6)