| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework:spring-expression | < 5.3.39 | 5.3.39 |
| spring framework | ≥ 5.3.0, < 5.3.39 | 5.3.39 |
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.
Specifically, an application is vulnerable when the following is true:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free