{"id":"CVE-2018-1257","published":"2018-05-11T20:00:00Z","modified":"2026-10-08T21:13:58Z","title":"Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows…","vendor":"Pivotal","product":"Spring Framework","tier":"tail","description":{"text":"Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03017,"percentile":0.87439,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/104260","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1809","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3768","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC"]},{"url":"https://pivotal.io/security/cve-2018-1257","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC"]}],"priority":{"score":17.5,"factors":[{"name":"EPSS percentile","points":17.49}]},"vendorSlug":"pivotal","affectedVersions":[{"vendor":"Pivotal","product":"Spring Framework","versions":["5.0.x prior to 5.0.6; 4.3.x prior to 4.3.17"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-core","vulnerableRanges":[">=5.0.0, <5.0.6","<4.3.17"],"patched":["5.0.6","4.3.17"],"from":["GHSA-rcpf-vj53-7h2m"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0682","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-1199","published":"2018-03-16","fixed":"5.0.3","kev":false},{"cve":"CVE-2018-1271","published":"2018-04-06","fixed":"5.0.5","kev":false},{"cve":"CVE-2018-1272","published":"2018-04-06","fixed":"5.0.5","kev":false,"link":{"from":"CVE-2018-1272","to":"CVE-2018-1257","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-core","fromFixed":"4.3.15","toFixed":"4.3.17","daysApart":35},{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-core","fromFixed":"5.0.5","toFixed":"5.0.6","daysApart":35}]}},{"cve":"CVE-2018-1257","published":"2018-05-11","fixed":"5.0.6","kev":false},{"cve":"CVE-2018-1258","published":"2018-05-11","fixed":"5.0.6.RELEASE","kev":false,"link":{"from":"CVE-2018-1257","to":"CVE-2018-1258","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-core","fromFixed":"5.0.6","toFixed":"5.0.6.RELEASE","daysApart":0}]}},{"cve":"CVE-2018-11040","published":"2018-06-25","fixed":"5.0.7.RELEASE","kev":false,"link":{"from":"CVE-2018-1257","to":"CVE-2018-11040","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-core","fromFixed":"4.3.17","toFixed":"4.3.18.RELEASE","daysApart":45}]}},{"cve":"CVE-2018-15756","published":"2018-10-18","fixed":"5.1.1.RELEASE","kev":false}],"package":"Maven:org.springframework:spring-core"}}