CVE-2023-34053
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
28/11/2023
Last modified:
13/02/2025
Description
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.<br />
<br />
Specifically, an application is vulnerable when all of the following are true:<br />
<br />
* the application uses Spring MVC or Spring WebFlux<br />
* io.micrometer:micrometer-core is on the classpath<br />
* an ObservationRegistry is configured in the application to record observations<br />
<br />
<br />
Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | 6.0.0 (including) | 6.0.14 (excluding) |
To consult the complete list of CPE names with products and versions, see this page