{"id":"CVE-2023-20861","published":"2023-03-23T00:00:00Z","modified":"2025-02-25T15:38:17Z","title":"In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0097,"percentile":0.61859,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://spring.io/security/cve-2023-20861","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20230420-0007/","tags":[]}],"priority":{"score":12.4,"factors":[{"name":"EPSS percentile","points":12.37}]},"affectedVersions":[{"vendor":"n/a","product":"Spring Framework","versions":["Spring Framework (6.0.0 to 6.0.6, 5.3.0 to 5.3.25, 5.2.0.RELEASE to 5.2.22.RELEASE, Older unsupported versions are also affected)"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-expression","vulnerableRanges":[">=6.0.0, <6.0.7",">=5.3.0, <5.3.26","<5.2.23.RELEASE"],"patched":["6.0.7","5.3.26","5.2.23.RELEASE"],"from":["GHSA-564r-hj7v-mcr5"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0877","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-spring-framework-cve-2022-22950","children":[{"from":"CVE-2023-20861","to":"CVE-2023-20863","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-expression","fromFixed":"5.3.26","toFixed":"5.3.27","daysApart":21},{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-expression","fromFixed":"6.0.7","toFixed":"6.0.8","daysApart":21},{"kind":"same-code","provenance":"machine","files":["spring-expression/src/main/java/org/springframework/expression/spel/standard/InternalSpelExpressionParser.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/430fc25acad2e85cbdddcd52b64481691f03ebd1","https://github.com/spring-projects/spring-framework/commit/52c93b1c4b24d70de233a958e60e7c5822bd274f","https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15","https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e"],"basis":"shared function","functions":["InternalSpelExpressionParser"]},{"kind":"similar","provenance":"machine","score":0.63,"basis":"same package + description similarity"}]},{"from":"CVE-2023-20861","to":"CVE-2024-38827","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-expression/src/main/java/org/springframework/expression/spel/standard/InternalSpelExpressionParser.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/430fc25acad2e85cbdddcd52b64481691f03ebd1","https://github.com/spring-projects/spring-framework/commit/52c93b1c4b24d70de233a958e60e7c5822bd274f","https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-22950","published":"2022-04-01","fixed":"5.3.17","kev":false,"link":{"from":"CVE-2022-22950","to":"CVE-2023-20861","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-expression","fromFixed":"5.3.17","toFixed":"5.3.26","daysApart":356}]}},{"cve":"CVE-2024-38808","published":"2024-08-20","fixed":"5.3.39","kev":false},{"cve":"CVE-2023-20861","published":"2023-03-23","fixed":"6.0.7","kev":false},{"cve":"CVE-2023-20863","published":"2023-04-13","fixed":"6.0.8","kev":false},{"cve":"CVE-2026-41850","published":"2026-06-09","fixed":"7.0.8","kev":false},{"cve":"CVE-2026-41851","published":"2026-06-09","fixed":"7.0.8","kev":false}],"package":"Maven:org.springframework:spring-expression"}}