DEBIAN-CVE-2024-38808

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/DEBIAN-CVE-2024-38808

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-38808.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2024-38808

Upstream

CVE-2024-38808

Published

2024-08-20T08:15:05Z

Modified

2025-09-18T05:20:03Z

Summary

[none]

Details

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.

References

https://security-tracker.debian.org/tracker/CVE-2024-38808

Affected packages

Debian:11 / libspring-java

Package

Name: libspring-java
Purl: pkg:deb/debian/libspring-java?arch=source

Affected ranges

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:12 / libspring-java

Package

Name: libspring-java
Purl: pkg:deb/debian/libspring-java?arch=source

Affected ranges

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / libspring-java

Package

Name: libspring-java
Purl: pkg:deb/debian/libspring-java?arch=source

Affected ranges

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:14 / libspring-java

Package

Name: libspring-java
Purl: pkg:deb/debian/libspring-java?arch=source

Affected ranges

Ecosystem specific

{
    "urgency": "unimportant"
}