{"id":"CVE-2023-34053","published":"2023-11-28T08:10:37Z","modified":"2025-02-13T16:55:14Z","title":"Spring Framework server Web Observations DoS Vulnerability","vendor":"Spring","product":"Spring Framework","tier":"tail","description":{"text":"In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n  *  the application uses Spring MVC or Spring WebFlux\n  *  io.micrometer:micrometer-core is on the classpath\n  *  an ObservationRegistry is configured in the application to record observations\n\n\nTypically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01159,"percentile":0.67084,"provenance":"source"},"cwes":[],"references":[{"url":"https://spring.io/security/cve-2023-34053","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20231214-0007/","tags":[]}],"priority":{"score":17.1,"factors":[{"name":"EPSS percentile","points":13.42},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"spring","affectedVersions":[{"vendor":"Spring","product":"Spring Framework","versions":[">= 6.0.0, < 6.0.14"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":[">=6.0.0, <6.0.14"],"patched":["6.0.14"],"from":["GHSA-v94h-hvhg-mf9h"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-3041","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-spring-framework-cve-2015-5211","children":[{"from":"CVE-2023-34053","to":"CVE-2024-38820","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-web/src/main/java/org/springframework/http/server/observation/DefaultServerRequestObservationConvention.java","spring-web/src/main/java/org/springframework/http/server/reactive/observation/DefaultServerRequestObservationConvention.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/c18784678df489d06a70e54fcddb5e3821d4b00c","https://github.com/spring-projects/spring-framework/commit/23656aebc6c7d0f9faff1080981eb4d55eff296c"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-22965","published":"2022-04-01","fixed":"5.3.18","kev":true},{"cve":"CVE-2024-38828","published":"2024-11-18","fixed":"5.3.42","kev":false},{"cve":"CVE-2023-20860","published":"2023-03-27","fixed":"6.0.7","kev":false,"link":{"from":"CVE-2023-20860","to":"CVE-2023-34053","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-webmvc","fromFixed":"6.0.7","toFixed":"6.0.14","daysApart":246}]}},{"cve":"CVE-2023-34053","published":"2023-11-28","fixed":"6.0.14","kev":false},{"cve":"CVE-2024-38816","published":"2024-09-13","fixed":"6.1.13","kev":false},{"cve":"CVE-2024-38819","published":"2024-12-19","fixed":"6.1.14","kev":false},{"cve":"CVE-2025-41242","published":"2025-08-18","fixed":"6.2.10","kev":false}],"package":"Maven:org.springframework:spring-webmvc"}}