CVE-2023-34053: Spring Framework server Web Observations DoS Vulnerability
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
the application uses Spring MVC or Spring WebFlux io.micrometer:micrometer-core is on the classpath an ObservationRegistry is configured in the application to record observations
Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-34053.
What is the title of this vulnerability?
The title of this vulnerability is Spring Framework server Web Observations DoS Vulnerability.
What is the severity of CVE-2023-34053?
The severity of CVE-2023-34053 is medium.
How does CVE-2023-34053 impact Spring Framework?
CVE-2023-34053 allows a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition in Spring Framework versions 6.0.0 - 6.0.13.
How can I fix CVE-2023-34053?
To fix CVE-2023-34053, you should update Spring Framework to version 6.0.14 or above.