{"id":"CVE-2024-38808","published":"2024-08-20T07:12:44Z","modified":"2024-10-30T18:41:27Z","title":"CVE-2024-38808: Spring Expression DoS Vulnerability","vendor":"Spring","product":"Spring Framework","tier":"tail","description":{"text":"In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.\n\nSpecifically, an application is vulnerable when the following is true:\n\n  *  The application evaluates user-supplied SpEL expressions.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00568,"percentile":0.4706,"provenance":"source"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"references":[{"url":"https://spring.io/security/cve-2024-38808","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20240920-0002/","tags":[]}],"priority":{"score":12.4,"factors":[{"name":"EPSS percentile","points":9.41},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"spring","affectedVersions":[{"vendor":"Spring","product":"Spring Framework","versions":[">= 5.3.0, < 5.3.39, 6.0+"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-expression","vulnerableRanges":["<5.3.39"],"patched":["5.3.39"],"from":["GHSA-9cmq-m9j5-mvww"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2544","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-spring-framework-cve-2022-22950","parents":[{"from":"CVE-2022-22950","to":"CVE-2024-38808","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-expression/src/main/java/org/springframework/expression/spel/ast/ConstructorReference.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11","https://github.com/spring-projects/spring-framework/commit/26f2dad388499faecf99e75b8856788e95d8d658","https://github.com/spring-projects/spring-framework/commit/f44d13cb7816e586b86c02421af4f5498391111c"],"basis":"shared function","functions":["createArray"]},{"kind":"similar","provenance":"machine","score":0.55,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2022-22950","published":"2022-04-01","fixed":"5.3.17","kev":false},{"cve":"CVE-2024-38808","published":"2024-08-20","fixed":"5.3.39","kev":false},{"cve":"CVE-2023-20861","published":"2023-03-23","fixed":"6.0.7","kev":false},{"cve":"CVE-2023-20863","published":"2023-04-13","fixed":"6.0.8","kev":false,"link":{"from":"CVE-2023-20863","to":"CVE-2024-38808","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-expression","fromFixed":"5.3.27","toFixed":"5.3.39","daysApart":495}]}},{"cve":"CVE-2026-41850","published":"2026-06-09","fixed":"7.0.8","kev":false}],"package":"Maven:org.springframework:spring-expression"}}