Spring Framework vulnerable to denial of service via specially crafted SpEL expression

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-20861 · ADVISORY
• spring-projects/spring-framework commit 430fc25 · WEB
• spring-projects/spring-framework commit 52c93b1 · WEB
• spring-projects/spring-framework commit 935c29e · WEB
• spring-projects/spring-framework · PACKAGE
• security.netapp.com/advisory/ntap-20230420-0007 · WEB
• spring.io/security/cve-2023-20861 · WEB
• security.netapp.com/advisory/ntap-20230420-0007

org.springframework:spring-expression のその他の脆弱性

• CVE-2026-41852中 5.3A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within rest…
• CVE-2026-41851高 7.5Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack …
• CVE-2026-41850高 7.5Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (D…
• CVE-2026-41849高 7.5An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by s…
• CVE-2024-38808中 4.3In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring …