| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.boot:spring-boot-autoconfigure | ≥ 2.6.0, < 2.6.15≥ 2.7.0, < 2.7.12≥ 3.0.0, < 3.0.7< 2.5.15 | 2.6.152.7.123.0.72.5.15 |
| spring boot | ≥ 2.6.0, ≤ 2.6.14≥ 2.7.0, ≤ 2.7.11≥ 3.0.0, ≤ 3.0.6< 2.5.14 | 2.5.14 |
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Specifically, an application is vulnerable if all of the conditions are true:
Your application is NOT vulnerable if any of the following are true:
Affected Spring Products and Versions
Spring Boot
3.0.0 to 3.0.6 2.7.0 to 2.7.11 2.6.0 to 2.6.14 2.5.0 to 2.5.14
Older, unsupported versions are also affected Mitigation
Users of affected versions should apply the following mitigations:
Users of older, unsupported versions should upgrade to 3.0.7+ or 2.7.12+.
Workarounds: configure the reverse proxy not to cache 404 responses and/or not to cache responses to requests to the root (/) of the application.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free