{"id":"CVE-2024-38809","aliases":["GHSA-2rmj-mq67-h97g"],"url":"https://o3.security/vulnerability/CVE-2024-38809","summary":"Spring Framework DoS via conditional HTTP request","details":"### Description\nApplications that parse ETags from `If-Match` or `If-None-Match` request headers are vulnerable to DoS attack.\n\n### Affected Spring Products and Versions\norg.springframework:spring-web in versions \n\n6.1.0 through 6.1.11\n6.0.0 through 6.0.22\n5.3.0 through 5.3.37\n\nOlder, unsupported versions are also affected\n\n### Mitigation\nUsers of affected versions should upgrade to the corresponding fixed version.\n6.1.x -> 6.1.12\n6.0.x -> 6.0.23\n5.3.x -> 5.3.38\nNo other mitigation steps are necessary.\n\nUsers of older, unsupported versions could enforce a size limit on `If-Match` and `If-None-Match` headers, e.g. through a Filter.","published":"2024-09-27T17:15:12Z","modified":"2026-04-10T05:13:30.432343Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.springframework:spring-web","fixedVersion":"5.3.38"},{"ecosystem":"Maven","name":"org.springframework:spring-web","fixedVersion":"6.0.23"},{"ecosystem":"Maven","name":"org.springframework:spring-web","fixedVersion":"6.1.12"}],"fix":{"url":"https://github.com/spring-projects/spring-framework/commit/582bfccbb72e5c8959a0b472d1dc7d03a20520f3","label":"spring-projects/spring-framework@582bfcc"},"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240920-0003/"},{"type":"WEB","url":"https://spring.io/security/cve-2024-38809"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38809"},{"type":"WEB","url":"https://github.com/spring-projects/spring-framework/issues/33372"},{"type":"WEB","url":"https://github.com/spring-projects/spring-framework/commit/582bfccbb72e5c8959a0b472d1dc7d03a20520f3"},{"type":"WEB","url":"https://github.com/spring-projects/spring-framework/commit/8d16a50907c11f7e6b407d878a26e84eba08a533"},{"type":"WEB","url":"https://github.com/spring-projects/spring-framework/commit/bb17ad8314b81850a939fd265fb53b3361705e85"},{"type":"PACKAGE","url":"https://github.com/spring-projects/spring-framework"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-04-10T05:13:30.432343Z"}}