Spring Security 5.7.x < 5.7.24 / 5.8.x < 5.8.26 / 6.3.x < 6.3.17 / 6.4.x < 6.4.17 / 6.5.x < 6.5.11 / 7.0.x < 7.0.6 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(320776);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/15");

  script_cve_id("CVE-2026-40988");
  script_xref(name:"IAVA", value:"2026-A-0562");

  script_name(english:"Spring Security 5.7.x < 5.7.24 / 5.8.x < 5.8.26 / 6.3.x < 6.3.17 / 6.4.x < 6.4.17 / 6.5.x < 6.5.11 / 7.0.x < 7.0.6 DoS");

  script_set_attribute(attribute:"synopsis", value:
"The Spring Security install on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Spring Security installed on the remote host is 5.7.x prior to 5.7.24, 5.8.x prior to 5.8.26, 6.3.x
prior to 6.3.17, 6.4.x prior to 6.4.17, 6.5.x prior to 6.5.11, or 7.0.x prior to 7.0.6. It is, therefore, affected
by a vulnerability:

  - An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or
    Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed
    SAML payload into memory. (CVE-2026-40988)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-40988");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Spring Security version 5.7.24, 5.8.26, 6.3.17, 6.4.17, 6.5.11, or 7.0.6 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-40988");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:spring_security");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("pivotal_software_spring_security_installed.nbin");
  script_require_keys("installed_sw/Spring Security");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Spring Security', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'5.7.0', 'fixed_version':'5.7.24'},
        {'min_version':'5.8.0', 'fixed_version':'5.8.26'},
        {'min_version':'6.3.0', 'fixed_version':'6.3.17'},
        {'min_version':'6.4.0', 'fixed_version':'6.4.17'},
        {'min_version':'6.5.0', 'fixed_version':'6.5.11'},
        {'min_version':'7.0.0', 'fixed_version':'7.0.6'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);