CVE-2018-15756 in Enterprise Manager for Fusion Applications
Summary
by MITRE
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability described in CVE-2018-15756 represents a critical denial of service weakness within the Spring Framework ecosystem that emerged from improper handling of HTTP range requests in static resource serving mechanisms. This flaw exists in multiple versions of the framework including Spring 4.3.x prior to 4.3.20, Spring 5.0.x prior to 5.0.10, and older unsupported versions on the 4.2.x branch. The vulnerability specifically targets applications that utilize ResourceHttpRequestHandler for serving static content or annotated controllers that return org.springframework.core.io.Resource objects, making it particularly dangerous for web applications that serve substantial amounts of static assets such as javascript files, css stylesheets, and image resources.
The technical implementation of this vulnerability stems from insufficient validation and resource management when processing HTTP range headers in the Spring Framework's resource handling components. When a malicious actor crafts a specially crafted HTTP request containing a range header with an excessive number of ranges or overlapping wide ranges, the framework's resource handler processes each range specification individually, leading to exponential resource consumption. This behavior creates a scenario where a single malicious request can consume significant CPU cycles and memory resources, effectively exhausting the application server's computational capacity. The vulnerability operates at the HTTP protocol level and leverages the legitimate range request functionality that allows clients to request specific portions of large files, but the implementation fails to impose reasonable limits on the number or size of ranges that can be requested simultaneously.
Applications affected by this vulnerability include those built on Spring Web MVC or Spring WebFlux frameworks, with Spring Boot applications being particularly at risk since they are configured to serve static resources out of the box through their default configurations. The impact extends across various deployment scenarios where static content delivery is enabled, making this vulnerability particularly widespread in enterprise environments where Spring Framework is extensively utilized. The operational consequences include complete service unavailability for legitimate users, increased server resource utilization, and potential system crashes or restarts that can disrupt business operations. This vulnerability directly maps to CWE-400, which describes unchecked resource consumption, and aligns with ATT&CK technique T1499.004 for network denial of service attacks. Organizations running vulnerable applications face significant operational risks including service degradation, user experience degradation, and potential revenue loss during attack windows.
Mitigation strategies for this vulnerability involve applying the latest security patches released by the Spring Framework team, specifically upgrading to versions 4.3.20, 5.0.10, or later. System administrators should also implement rate limiting and request validation mechanisms at the application level or through reverse proxies to prevent excessive range header processing. Additionally, organizations should consider implementing resource quotas and monitoring for unusual patterns of range request usage that could indicate exploitation attempts. Network-level protections such as intrusion detection systems can help identify and block malicious range request patterns, while application firewalls can provide additional layers of defense against crafted malicious requests targeting this specific vulnerability. Regular security assessments and penetration testing should be conducted to identify and remediate similar weaknesses in the application architecture, ensuring comprehensive protection against resource exhaustion attacks.