Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process…
Priority LOW 30CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 fixed, 5 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-119 and the CVSS impact.
Summary
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Why it matters now
EPSS 0.02555 85th percentileScored 2026-11-07
Fix Partial org.springframework:spring-web (Maven): 3.2.14, 4.1.7, 5.0.0.RC3Red Hat: 6 advisoriesRed Hat: 6 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.springframework:spring-web (Maven) | before 3.2.14 | 3.2.14 | Patch available | GHSA-6v7w-535j-rq5m |
| — | org.springframework:spring-web (Maven) | 4.0.0 to before 4.1.7 | 4.1.7 | Patch available | GHSA-6v7w-535j-rq5m |
| — | org.springframework:spring-web (Maven) | 5.0.0.RC2 to before 5.0.0.RC3 | 5.0.0.RC3 | Patch available | GHSA-6v7w-535j-rq5m |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.springframework:spring-web (Maven) Vendor— Affected before 3.2.14 Fixed in 3.2.14 Patch available GHSA-6v7w-535j-rq5m
- org.springframework:spring-web (Maven) Vendor— Affected 4.0.0 to before 4.1.7 Fixed in 4.1.7 Patch available GHSA-6v7w-535j-rq5m
- org.springframework:spring-web (Maven) Vendor— Affected 5.0.0.RC2 to before 5.0.0.RC3 Fixed in 5.0.0.RC3 Patch available GHSA-6v7w-535j-rq5m
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal_software:spring_framework:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:* | 3.2.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:* | 3.2.2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:* | 3.2.3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:* | 3.2.4 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.5:*:*:*:*:*:*:* | 3.2.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.6:*:*:*:*:*:*:* | 3.2.6 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.7:*:*:*:*:*:*:* | 3.2.7 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.8:*:*:*:*:*:*:* | 3.2.8 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.9:*:*:*:*:*:*:* | 3.2.9 | Vulnerable | VMware |
- cpe:2.3:a:pivotal_software:spring_framework:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.7:*:*:*:*:*:*:* Versions 3.2.7 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.8:*:*:*:*:*:*:* Versions 3.2.8 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.9:*:*:*:*:*:*:* Versions 3.2.9 Vulnerable ·VMware
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_framework:3.2.10:*:*:*:*:*:*:* | 3.2.10 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.11:*:*:*:*:*:*:* | 3.2.11 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.12:*:*:*:*:*:*:* | 3.2.12 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:3.2.13:*:*:*:*:*:*:* | 3.2.13 | Vulnerable | VMware |
| cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:* | 21 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* | 22 | Vulnerable | Fedoraproject |
| cpe:2.3:a:pivotal_software:spring_framework:4.1.0:*:*:*:*:*:*:* | 4.1.0 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:vmware:spring_framework:4.1.1:*:*:*:*:*:*:* | 4.1.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:4.1.2:*:*:*:*:*:*:* | 4.1.2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:4.1.3:*:*:*:*:*:*:* | 4.1.3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:4.1.4:*:*:*:*:*:*:* | 4.1.4 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:4.1.5:*:*:*:*:*:*:* | 4.1.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_framework:4.1.6:*:*:*:*:*:*:* | 4.1.6 | Vulnerable | VMware |
- cpe:2.3:a:vmware:spring_framework:3.2.10:*:*:*:*:*:*:* Versions 3.2.10 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.11:*:*:*:*:*:*:* Versions 3.2.11 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.12:*:*:*:*:*:*:* Versions 3.2.12 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:3.2.13:*:*:*:*:*:*:* Versions 3.2.13 Vulnerable ·VMware
- cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:* Versions 21 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* Versions 22 Vulnerable ·Fedoraproject
- cpe:2.3:a:pivotal_software:spring_framework:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:vmware:spring_framework:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:4.1.3:*:*:*:*:*:*:* Versions 4.1.3 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:4.1.4:*:*:*:*:*:*:* Versions 4.1.4 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:4.1.5:*:*:*:*:*:*:* Versions 4.1.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_framework:4.1.6:*:*:*:*:*:*:* Versions 4.1.6 Vulnerable ·VMware
Remediation
- Fix · GHSA-6v7w-535j-rq5m org.springframework:spring-web (Maven) Fixed in 3.2.14 Advisory →
- Fix · GHSA-6v7w-535j-rq5m org.springframework:spring-web (Maven) Fixed in 4.1.7 Advisory →
- Fix · GHSA-6v7w-535j-rq5m org.springframework:spring-web (Maven) Fixed in 5.0.0.RC3 Advisory →
Red Hat 6 advisories
- RHSA-2016:2035 Released 2016-10-06 · Red Hat rating ImportantRed Hat JBoss Fuse 6.3 security update
- Red Hat JBoss Fuse 6.3
- RHSA-2016:2036 Released 2016-10-06 · Red Hat rating ImportantRed Hat JBoss A-MQ 6.3 security update
- Red Hat JBoss A-MQ 6.3
- RHSA-2016:1592 Released 2016-08-10 · Red Hat rating ModerateRed Hat JBoss BRMS 6.3.2 security and bug fix update
- Red Hat JBoss BRMS 6.3
Show 3 more Red Hat advisories
- RHSA-2016:1593 Released 2016-08-10 · Red Hat rating ModerateRed Hat JBoss BPM Suite 6.3.2 security and bug fix update
- Red Hat JBoss BPMS 6.3
- RHSA-2016:1218 Released 2016-06-09 · Red Hat rating ModerateRed Hat JBoss BPM Suite security and bug fix update
- Red Hat JBoss BPMS 6.2
- RHSA-2016:1219 Released 2016-06-09 · Red Hat rating ModerateRed Hat JBoss BRMS security and bug fix update
- Red Hat JBoss BRMS 6.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Virtualization 3 | Affected | — |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2016:2036 |
| Red Hat JBoss BPMS 6.2 | Fixed | RHSA-2016:1218 |
| Red Hat JBoss BPMS 6.3 | Fixed | RHSA-2016:1593 |
| Red Hat JBoss BRMS 6.2 | Fixed | RHSA-2016:1219 |
| Red Hat JBoss BRMS 6.3 | Fixed | RHSA-2016:1592 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2016:2035 |
Timeline
- 2026-10-02 Threatist record created from CVE-2015-3192
- 2026-10-03 Alias added: GHSA-6v7w-535j-rq5m
References
Advisory 11
Other 13
- https://jira.spring.io/browse/SPR-13136
- [debian-lts-announce] 20190713 [SECURITY] [DLA 1853-1] libspring-java security update
- https://github.com/spring-projects/spring-framework/issues/17727
- https://github.com/spring-projects/spring-framework/issues/20352
- https://github.com/spring-projects/spring-framework/commit/0411435bac835de88a80a64b3f67b1b89244e907
- https://github.com/spring-projects/spring-framework/commit/38b8262e1e2db9be9d2171d81547da5c65ba7e09
- https://github.com/spring-projects/spring-framework/commit/5a711c05ec750f069235597173084c2ee7962424
- https://github.com/spring-projects/spring-framework/commit/9c3580d04e84d25a90ef4c249baee1b4e02df15e
- https://github.com/spring-projects/spring-framework/commit/d79ec68db40c381b8e205af52748ebd3163ee33b
- https://github.com/spring-projects/spring-framework/commit/e4651d6b50c5bc85c84ff537859c212ac4e33434
- https://spring.io/security/cve-2015-3192
- https://jira.spring.io/browse/SPR-13136?redirect=false
- https://github.com/spring-projects/spring-framework
Sources
- CVE-2015-3192 · CVE Program
- CVE-2015-3192 · NVD
- FIRST EPSS
- GHSA-6v7w-535j-rq5m · GitHub Advisory Database · CC BY 4.0
- CVE-2015-3192 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences