Forwarded header exploit with Spring HATEOAS on WebFlux
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring HATEOAS | 1.5.4 or older; 2.0.4 or older; 2.1.0 | — | No fix listed | CNA |
| — | org.springframework.hateoas:spring-hateoas (Maven) | before 1.5.5 | 1.5.5 | Patch available | GHSA-7m5c-fgwf-mwph |
| — | org.springframework.hateoas:spring-hateoas (Maven) | 2.0.0 to before 2.0.5 | 2.0.5 | Patch available | GHSA-7m5c-fgwf-mwph |
| — | org.springframework.hateoas:spring-hateoas (Maven) | 2.1.0 to before 2.1.1 | 2.1.1 | Patch available | GHSA-7m5c-fgwf-mwph |
- Spring HATEOAS VendorVMware Affected 1.5.4 or older; 2.0.4 or older; 2.1.0 Fixed in — No fix listed CNA
- org.springframework.hateoas:spring-hateoas (Maven) Vendor— Affected before 1.5.5 Fixed in 1.5.5 Patch available GHSA-7m5c-fgwf-mwph
- org.springframework.hateoas:spring-hateoas (Maven) Vendor— Affected 2.0.0 to before 2.0.5 Fixed in 2.0.5 Patch available GHSA-7m5c-fgwf-mwph
- org.springframework.hateoas:spring-hateoas (Maven) Vendor— Affected 2.1.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-7m5c-fgwf-mwph
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_hateoas:*:*:*:*:*:*:*:* | before 1.5.5; 2.0.0 to before 2.0.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_hateoas:2.1.0:-:*:*:*:*:*:* | 2.1.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_hateoas:2.1.0:milestone1:*:*:*:*:*:* | 2.1.0 milestone1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_hateoas:2.1.0:rc1:*:*:*:*:*:* | 2.1.0 rc1 | Vulnerable | VMware |
- cpe:2.3:a:vmware:spring_hateoas:*:*:*:*:*:*:*:* Versions before 1.5.5; 2.0.0 to before 2.0.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_hateoas:2.1.0:-:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_hateoas:2.1.0:milestone1:*:*:*:*:*:* Versions 2.1.0 milestone1 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_hateoas:2.1.0:rc1:*:*:*:*:*:* Versions 2.1.0 rc1 Vulnerable ·VMware
Remediation
- Fix · GHSA-7m5c-fgwf-mwph org.springframework.hateoas:spring-hateoas (Maven) Fixed in 1.5.5 Advisory →
- Fix · GHSA-7m5c-fgwf-mwph org.springframework.hateoas:spring-hateoas (Maven) Fixed in 2.0.5 Advisory →
- Fix · GHSA-7m5c-fgwf-mwph org.springframework.hateoas:spring-hateoas (Maven) Fixed in 2.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34036
- 2026-10-03 Alias added: GHSA-7m5c-fgwf-mwph
References
More VMware Spring Hateoas vulnerabilities
- TI-2026-29658 Spring HATEOAS heap exhaustion through unbounded internal caching CVSS 3.1HIGH 7.5
- TI-2026-29657 Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration CVSS 3.1HIGH 7.5
Sources
- CVE-2023-34036 · CVE Program
- CVE-2023-34036 · NVD
- FIRST EPSS
- GHSA-7m5c-fgwf-mwph · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences