Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreCVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter
Description
Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
Affected Spring Products and Versions
Spring Framework:
- 5.3.0 - 5.3.41
- Older, unsupported versions are also affected
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 5.3.x | 5.3.42 | Commercial |
No further mitigation steps are necessary.
In older, unsupported versions, an application could declare an InputStream method parameter instead to access the request body.
Credit
This issues was responsibly reported by macter.
References
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all