Read the docs
TI-2024-14823 Aliases CVE-2024-22233GHSA-r4q3-7g4q-x89m

CVE-2024-22233: Spring Framework server Web DoS Vulnerability

Priority LOW 35CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC * Spring Security 6.1.6+ or 6.2.1+ is on the classpath Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01048 64th percentileScored 2026-11-07
Fix Partial org.springframework:spring-core (Maven): 6.1.3, 6.0.16Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Framework6.1.2; 6.0.15—No fix listedCNA
—org.springframework:spring-core (Maven)6.1.2 to before 6.1.36.1.3Patch availableGHSA-r4q3-7g4q-x89m
—org.springframework:spring-core (Maven)6.0.15 to before 6.0.166.0.16Patch availableGHSA-r4q3-7g4q-x89m
  • Spring Framework VendorVMware Affected 6.1.2; 6.0.15 Fixed in — No fix listed CNA
  • org.springframework:spring-core (Maven) Vendor— Affected 6.1.2 to before 6.1.3 Fixed in 6.1.3 Patch available GHSA-r4q3-7g4q-x89m
  • org.springframework:spring-core (Maven) Vendor— Affected 6.0.15 to before 6.0.16 Fixed in 6.0.16 Patch available GHSA-r4q3-7g4q-x89m

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:6.0.15:*:*:*:*:*:*:*6.0.15VulnerableVMware
cpe:2.3:a:vmware:spring_framework:6.1.2:*:*:*:*:*:*:*6.1.2VulnerableVMware
  • cpe:2.3:a:vmware:spring_framework:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_framework:6.1.2:*:*:*:*:*:*:* Versions 6.1.2 Vulnerable ·VMware

Remediation

  • Fix · GHSA-r4q3-7g4q-x89m org.springframework:spring-core (Maven) Fixed in 6.1.3 Advisory →
  • Fix · GHSA-r4q3-7g4q-x89m org.springframework:spring-core (Maven) Fixed in 6.0.16 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat support for Spring BootAffectedNo fix planned: Will not fix
Not affected: 17 products
  • A-MQ Clients 2
  • Migration Toolkit for Runtimes
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Application Runtimes
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of OptaPlanner 8
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22233
  2. 2026-10-03 Alias added: GHSA-r4q3-7g4q-x89m

References

Advisory 2

Other 3

  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
  • TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
  • TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences