Spring Boot Actuator denial of service vulnerability

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring M...

com.github.drtrang:druid-spring-boot-actuator-autoconfigure (1.1.9.1), com.github.drtrang:druid-spring-boot-actuator-starter (1.1.9.1) +68 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.11.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.drtrang:druid-spring-boot-actuator-autoconfigure...

com.brinkus.labs:labs-cloud-starter-neo4j (1.6.1), com.brinkus.labs:labs-cloud-starter-service (1.6.1) +321 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.7.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.brinkus.labs:labs-cloud-starter-neo4j 1.6.1 -...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-fragmentisers (>=1.1.0, <=3.4.0) +1437 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (>=3.1.0, <=3.1.5)

org.springframework.boot:spring-boot-actuator MAVEN version =3.1.0, =1.1.0, =2.3.0, =1.1.0, =1.1.0, =2.10.0, =1.1.0, =1.1.0, =2.3.0, =1.1.0, =1.1.0, =1.1.0, =2.3.0, =3.6.0, =3.6.1 - be.vlaanderen.informatievlaanderen...

com.alibaba.cloud:spring-cloud-alibaba-sentinel-gateway (1.5.1.release), com.alibaba.cloud:spring-cloud-starter-bus-rocketmq (1.5.1.release) +41 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.21.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.alibaba.cloud:spring-cloud-alibaba-sentinel-gateway...

io.github.resilience4j:resilience4j-spring-boot (>=0.12.0, <=0.12.1), org.springframework.boot:spring-boot-actuator-docs (1.5.5.release) +3 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.5.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - io.github.resilience4j:resilience4j-spring-boot =0.12.0,...

com.17jee:e-cloud-authorize (>=3.0.0, <=3.0.1.1), com.17jee:e-cloud-oauth (>=3.0.0, <=3.0.1.1) +65 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.3.7.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.17jee:e-cloud-authorize =3.0.0, =3.0.0, =3.0.0.release,...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +68 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.3.0.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-start...

org.springframework.boot:spring-boot-docs (1.1.11.release), org.springframework.boot:spring-boot-starter-actuator (1.1.11.release) +1 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.11.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - org.springframework.boot:spring-boot-docs 1.1.11.release -...

com.github.zed-platform:zed-service-attachment-file (>=0.0.9, <=0.0.10), com.github.zed-platform:zed-service-document-mongo (>=0.0.8, <=0.0.10) +14 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.2.0.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.zed-platform:zed-service-attachment-file =0.0.9,...

com.github.zed-platform:zed-service-attachment-file (0.0.20), com.github.zed-platform:zed-service-document-elasticsearch (0.0.20) +30 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.2.2.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.zed-platform:zed-service-attachment-file 0.0.20 -...

com.moelholm.tools:actuator-ui-dump (>=0.1, <=0.2), de.codecentric:spring-boot-admin-sample (1.2.4) +27 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.2.7.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.moelholm.tools:actuator-ui-dump =0.1, =0.41.0, =0.41.0,...

cn.home1:oss-admin (>=1.0.6.oss, <=1.0.7.oss), cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss) +661 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.4.1.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - cn.home1:oss-admin =1.0.6.oss, =1.0.6.oss, =1.0.6.oss,...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), com.github.timpeeters:spring-boot-actuator-server-config (1.0.3) +10 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.17.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter 0.1.8 -...

cn.dubby:itbus (>=0.2.7, <=0.2.8), com.cedarsoftware:n-cube (>=4.0.6, <=4.0.16) +278 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.3.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - cn.dubby:itbus =0.2.7, =4.0.6, =2.0.2-release, =1.0.7, =1.0.7...

com.alibaba.spring.boot:dubbo-spring-boot-starter (>=1.0.1, <=2.0.0), com.almis.awe:awe-annotation (>=4.1.0, <=4.1.1) +171 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.10.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.alibaba.spring.boot:dubbo-spring-boot-starter =1.0.1,...

com.jdcloud.jdsf:spring-cloud-jdsf-core (1.0.0-edgware), com.taboola:async-profiler-actuator-endpoint (>=0.0.2, <=2.0.8) +27 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.20.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.jdcloud.jdsf:spring-cloud-jdsf-core 1.0.0-edgware -...

ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +7126 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (>=2.0.0.release, <=2.7.17)

org.springframework.boot:spring-boot-actuator MAVEN version =2.0.0.release, =0.1.2, =0.5.0, =0.5.21, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2023-34055 Source advisory:...

com.alibaba:tac-console (0.0.4), com.alibaba:tac-container (0.0.4) +26 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.4.7.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.alibaba:tac-console 0.0.4 - com.alibaba:tac-container 0.0...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +27 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.4.4.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: -...