CVE-2024-38809

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.

Users of affected versions should upgrade to the corresponding fixed version.

Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
N/ASpring Framework6.1.0 - 6.1.11, 6.0.0 - 6.0.22, 5.3.0 - 5.3.37
vmwarespring_framework>= 6.1.0, <= 6.1.11; >= 6.0.0, <= 6.0.22; >= 5.3.0, <= 5.3.37

References

Timeline

Published
Sep 27, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-38818.8A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical. This issue affects the function frmL7PlotForm of the file CVE-2024-388107.5Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inCVE-2024-388117.8VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious aCVE-2024-388129.8The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network accesCVE-2024-388139.8The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vCVE-2024-388148.8An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-adminiCVE-2024-388154.3VMware NSX contains a content spoofing vulnerability.  An unauthenticated malicious actor may be able to craft a URL and redirect a victim CVE-2024-388167.5Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacksCVE-2024-388176.7VMware NSX contains a command injection vulnerability.  A malicious actor with access to the NSX Edge CLI terminal may be able to craft malCVE-2024-388186.7VMware NSX contains a local privilege escalation vulnerability.  An authenticated malicious actor may exploit this vulnerability to obtain CVE-2024-388197.5Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacksCVE-2024-38828.8A vulnerability was found in Tenda W30E 1.0.1.25(633). It has been classified as critical. Affected is the function fromRouteStatic of the f
CVE-2024-38809: Medium severity, CVSS 5.3 | Vulnix