Most recent entries from all

bdu:2024-08650

certfr-2024-avi-0689 — De multiples vulnérabilités ont été découvertes dans Spring Framework. Elles permettent à un attaquant de provoquer un…

certfr-2024-avi-0689

EUVD-2026-189869

fkie_cve-2024-38809

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.

Users of affected versions should upgrade to the corresponding fixed version.

Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.

GHSA-2rmj-mq67-h97g — Spring Framework DoS via conditional HTTP request

Affected: Maven: org.springframework:spring-web

### Description Applications that parse ETags from `If-Match` or `If-None-Match` request headers are vulnerable to DoS attack.

### Affected Spring Products and Versions org.springframework:spring-web in versions

6.1.0 through 6.1.11 6.0.0 through 6.0.22 5.3.0 through 5.3.37

Older, unsupported versions are also affected

### Mitigation Users of affected versions should upgrade to the corresponding fixed version. 6.1.x -> 6.1.12 6.0.x -> 6.0.23 5.3.x -> 5.3.38 No other mitigation steps are necessary.

Users of older, unsupported versions could enforce a size limit on `If-Match` and `If-None-Match` headers, e.g. through a Filter.

RHSA-2024:8064 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.4.3 for Spring Boot security update.

nimbus-jose-jwt: large JWE p2c header value causes Denial of Service protobuf: StackOverflow vulnerability in Protocol Buffers org.springframework:spring-web: Spring Framework DoS via conditional HTTP request spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource org.hl7.fhir.core: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r4b: org.hl7.fhir.r5: org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core` apache-avro: Schema parsing may trigger Remote Code Execution (RCE)

UBUNTU-CVE-2024-38809

Affected: Ubuntu:Pro:14.04:LTS: libspring-java, Ubuntu:Pro:16.04:LTS: libspring-java, Ubuntu:Pro:18.04:LTS: libspring-java, Ubuntu:Pro:20.04:LTS: libspring-java, Ubuntu:Pro:22.04:LTS: libspring-java, Ubuntu:Pro:24.04:LTS: libspring-java, Ubuntu:25.10: libspring-java, Ubuntu:26.04:LTS: libspring-java

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.

WID-SEC-W-2024-1853 — VMware Tanzu Spring Framework: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um einen Denial of Service Angriff durchzuführen.