Vmware Spring Framework up to 5.3.41 MVC Controller denial of service

Summaryinfo

A vulnerability was found in Vmware Spring Framework up to 5.3.41 and classified as problematic. Affected is an unknown function of the component MVC Controller. Executing a manipulation can lead to denial of service. This vulnerability is tracked as CVE-2024-38828. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Vmware Spring Framework up to 5.3.41. This vulnerability affects an unknown code of the component MVC Controller. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

The advisory is shared for download at spring.io. This vulnerability was named CVE-2024-38828 since 06/20/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 211637 (Spring Framework 5.3.x < 5.3.42 DoS (CVE-2024-38828)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.3.42 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (211637) and CERT Bund (WID-SEC-2026-0559). Once again VulDB remains the best source for vulnerability data.

Affected

• IBM Rational Build Forge

Productinfo

Vendor

• Vmware

Name

• Spring Framework

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11
• 5.3.12
• 5.3.13
• 5.3.14
• 5.3.15
• 5.3.16
• 5.3.17
• 5.3.18
• 5.3.19
• 5.3.20
• 5.3.21
• 5.3.22
• 5.3.23
• 5.3.24
• 5.3.25
• 5.3.26
• 5.3.27
• 5.3.28
• 5.3.29
• 5.3.30
• 5.3.31
• 5.3.32
• 5.3.33
• 5.3.34
• 5.3.35
• 5.3.36
• 5.3.37
• 5.3.38
• 5.3.39
• 5.3.40
• 5.3.41

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion