{"id":"CVE-2023-20863","published":"2023-04-13T00:00:00Z","modified":"2025-02-07T16:48:13Z","title":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a…","vendor":null,"product":null,"tier":"tail","description":{"text":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01122,"percentile":0.66183,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://spring.io/security/cve-2023-20863","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0015/","tags":[]}],"priority":{"score":17.8,"factors":[{"name":"EPSS percentile","points":13.24},{"name":"CVSS severity","points":4.55}]},"affectedVersions":[{"vendor":"n/a","product":"Spring Framework","versions":["Spring framework versions 5.2.x.release prior to 5.2.24.release+, 5.3.x prior to 5.3.27+, 6.0.x prior to 6.0.8+ and older unsupported versions"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-expression","vulnerableRanges":[">=6.0.0, <6.0.8",">=5.3.0, <5.3.27","<5.2.24.RELEASE"],"patched":["6.0.8","5.3.27","5.2.24.RELEASE"],"from":["GHSA-wxqc-pxw9-g2p8"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1417","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-spring-framework-cve-2022-22950","parents":[{"from":"CVE-2023-20861","to":"CVE-2023-20863","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-expression","fromFixed":"5.3.26","toFixed":"5.3.27","daysApart":21},{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-expression","fromFixed":"6.0.7","toFixed":"6.0.8","daysApart":21},{"kind":"same-code","provenance":"machine","files":["spring-expression/src/main/java/org/springframework/expression/spel/standard/InternalSpelExpressionParser.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/430fc25acad2e85cbdddcd52b64481691f03ebd1","https://github.com/spring-projects/spring-framework/commit/52c93b1c4b24d70de233a958e60e7c5822bd274f","https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15","https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e"],"basis":"shared function","functions":["InternalSpelExpressionParser"]},{"kind":"similar","provenance":"machine","score":0.63,"basis":"same package + description similarity"}]},{"from":"CVE-2022-22950","to":"CVE-2023-20863","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-expression/src/main/java/org/springframework/expression/spel/SpelMessage.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11","https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15","https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2023-20863","to":"CVE-2024-38827","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-expression/src/main/java/org/springframework/expression/spel/standard/InternalSpelExpressionParser.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15","https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e","https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-22950","published":"2022-04-01","fixed":"5.3.17","kev":false},{"cve":"CVE-2024-38808","published":"2024-08-20","fixed":"5.3.39","kev":false,"link":{"from":"CVE-2023-20863","to":"CVE-2024-38808","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-expression","fromFixed":"5.3.27","toFixed":"5.3.39","daysApart":495}]}},{"cve":"CVE-2023-20861","published":"2023-03-23","fixed":"6.0.7","kev":false},{"cve":"CVE-2023-20863","published":"2023-04-13","fixed":"6.0.8","kev":false},{"cve":"CVE-2026-41850","published":"2026-06-09","fixed":"7.0.8","kev":false},{"cve":"CVE-2026-41851","published":"2026-06-09","fixed":"7.0.8","kev":false},{"cve":"CVE-2026-41852","published":"2026-06-09","fixed":"7.0.8","kev":false}],"package":"Maven:org.springframework:spring-expression"}}