CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter
Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.springframework:spring-webmvcto a version that resolves this vulnerability.Fixed in 5.3.42
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38828?
CVE-2024-38828 has been classified as a high severity vulnerability due to its potential for denial of service attacks.
How do I fix CVE-2024-38828?
To fix CVE-2024-38828, upgrade to Spring Framework version 5.3.42 or later.
What versions of Spring MVC are affected by CVE-2024-38828?
CVE-2024-38828 affects Spring MVC versions from 5.3.0 through 5.3.41.
What type of attack does CVE-2024-38828 allow?
CVE-2024-38828 allows attackers to perform denial of service (DoS) attacks against applications using vulnerable Spring MVC controller methods.
Is CVE-2024-38828 associated with any specific software?
CVE-2024-38828 specifically impacts the Spring Web MVC framework in the affected versions.