CVE-2024-22233

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

* the application uses Spring MVC * Spring Security 6.1.6+ or 6.2.1+ is on the classpath

Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Jan 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-222347.4In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control w CVE-2024-222356.7VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system CVE-2024-222365.5In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution i CVE-2024-222377.8Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks CVE-2024-222384.8Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject ma CVE-2024-222397.8Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks CVE-2024-22249.8Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender Gr CVE-2024-222404.9Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerabilit CVE-2024-222414.8Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious p CVE-2024-222438.1Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation check CVE-2024-222446.1Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.CVE-2024-222459.6Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow