{"id":"CVE-2024-38828","published":"2024-11-18T03:45:46Z","modified":"2025-05-09T20:03:35Z","title":"CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter","vendor":"Spring","product":"Spring","tier":"tail","description":{"text":"Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00724,"percentile":0.53895,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://spring.io/security/cve-2024-38828","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250509-0009/","tags":[]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":10.78},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.71}]},"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2025-04-14","earliestUrl":"https://github.com/First-Roman/sprig-mvc-demo-patch","repos":[{"name":"First-Roman/sprig-mvc-demo-patch","url":"https://github.com/First-Roman/sprig-mvc-demo-patch","stars":0,"created":"2025-04-14"},{"name":"topilov/axiom-jdk-test-task","url":"https://github.com/topilov/axiom-jdk-test-task","stars":0,"created":"2025-04-21"}]},"first":{"date":"2025-04-14","source":"PoC-in-GitHub","url":"https://github.com/First-Roman/sprig-mvc-demo-patch"},"provenance":"source"},"vendorSlug":"spring","affectedVersions":[{"vendor":"Spring","product":"Spring","versions":[">= 5.3.x, < 5.3.42"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":[">=5.3.0, <5.3.42"],"patched":["5.3.42"],"from":["GHSA-w3c8-7r8f-9jp8"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3320","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-5397","published":"2020-01-17","fixed":"5.2.3","kev":false},{"cve":"CVE-2020-5398","published":"2020-01-16","fixed":"5.2.3.RELEASE","kev":false},{"cve":"CVE-2022-22965","published":"2022-04-01","fixed":"5.3.18","kev":true},{"cve":"CVE-2024-38828","published":"2024-11-18","fixed":"5.3.42","kev":false},{"cve":"CVE-2023-20860","published":"2023-03-27","fixed":"6.0.7","kev":false,"link":{"from":"CVE-2023-20860","to":"CVE-2024-38828","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-webmvc","fromFixed":"5.3.26","toFixed":"5.3.42","daysApart":602}]}},{"cve":"CVE-2023-34053","published":"2023-11-28","fixed":"6.0.14","kev":false},{"cve":"CVE-2024-38816","published":"2024-09-13","fixed":"6.1.13","kev":false}],"package":"Maven:org.springframework:spring-webmvc"}}