Asymmetric denial of service - ReDoS In libspring-java
Description
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | - | ||
debian 14 | - | ||
debian 12 | - | ||
debian 13 | - | ||
 maven | 5.3.38, 6.0.23, 6.1.12 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5.