CVE-2024-38808
Fixed in a distro release EPSS <1%CVSS 4.3
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
Products: Spring Framework
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework:spring-expression | 5.3.39 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-nifi | 1.27.0-r1 |
| Chainguard | apache-nifi-compat | 1.27.0-r1 |
| Chainguard | apache-nifi-toolkit | 1.27.0-r1 |
| Chainguard | jenkins | 2.473-r0 |
| Chainguard | jenkins-2.452 | 2.452.4-r1 |
| Chainguard | jenkins-2.462 | 2.462.1-r1 |
| Chainguard | jenkins-compat | 2.473-r0 |
| Chainguard | jenkins-remoting | 2.473-r0 |
| Debian:12 | libspring-java | no fix |
| Debian:13 | libspring-java | no fix |
| Debian:14 | libspring-java | no fix |
| Red Hat:ocp_tools:4.12 | jenkins | 0:2.462.3.1730119132-3.el8 |
| Red Hat:ocp_tools:4.12 | jenkins-2-plugins | 0:4.12.1730119231-1.el8 |
| Red Hat:ocp_tools:4.13 | jenkins | 0:2.462.3.1729839924-3.el8 |
| Red Hat:ocp_tools:4.13 | jenkins-2-plugins | 0:4.13.1729840148-1.el8 |
| Red Hat:ocp_tools:4.14 | jenkins | 0:2.462.3.1729839727-3.el8 |
| Red Hat:ocp_tools:4.14 | jenkins-2-plugins | 0:4.14.1729839844-1.el8 |
| Red Hat:ocp_tools:4.15 | jenkins | 0:2.462.3.1729837947-3.el8 |
| Red Hat:ocp_tools:4.15 | jenkins-2-plugins | 0:4.15.1729838165-1.el8 |
| Ubuntu:25.10 | libspring-java | no fix |
| Ubuntu:26.04:LTS | libspring-java | no fix |
| Ubuntu:26.10 | libspring-java | no fix |
| Ubuntu:Pro:14.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:16.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:18.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:20.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:22.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:24.04:LTS | libspring-java | no fix |
| Wolfi | apache-nifi | 1.27.0-r1 |
| Wolfi | apache-nifi-compat | 1.27.0-r1 |
| Wolfi | apache-nifi-toolkit | 1.27.0-r1 |
| Wolfi | jenkins | 2.473-r0 |
| Wolfi | jenkins-compat | 2.473-r0 |
| Wolfi | jenkins-remoting | 2.473-r0 |