CVE-2024-38809 Spring Framework DoS via conditional HTTP request
Attackers can cause denial of service in applications parsing ETags from If-Match or If-None-Match headers by sending malicious requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38809?
CVE-2024-38809 is a medium-severity denial of service vulnerability in Spring Framework, published on 27 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.
Users of affected versions should upgrade to the corresponding fixed version.
Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
Weakness: CWE-400
Which versions are affected by CVE-2024-38809?
6 open source packages ship an affected version, including org.springframework:spring-web.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework:spring-web Maven | All versions | 5.3.38 |
org.springframework:spring-web Maven | All versions | 5.3.38 |
org.springframework:spring-web Maven | From 6.0.0 | 6.0.23 |
org.springframework:spring-web Maven | From 6.0.0 | 6.0.23 |
org.springframework:spring-web Maven | From 6.1.0 | 6.1.12 |
org.springframework:spring-web Maven | From 6.1.0 | 6.1.12 |
How do I fix CVE-2024-38809?
Upgrade org.springframework:spring-web to a fixed version for your release line: 5.3.38, 6.0.23 or 6.1.12.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-38809 being exploited?
There is no known exploitation of CVE-2024-38809 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-38809, ECHO-63db-3dde-a92a, GHSA-2rmj-mq67-h97g, ROOT-APP-MAVEN-CVE-2024-38809, UBUNTU-CVE-2024-38809.