ba.jamax.util:jamax-rest (>=1.3.1-release, <=1.3.4-release), biz.dfch.j:activiti.wrapper (>=0.0.6, <=0.0.7) +651 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (4.1.6.release)

org.springframework:spring-web MAVEN version 4.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ba.jamax.util:jamax-rest =1.3.1-release, =0.0.6, =0.1.0, =0.1.5, =0.4.0, =0.4.0, =1.0.83-rc...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-application (>=1.0.0, <=1.2.0) +17340 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (>=5.3.0, <=5.3.39)

org.springframework:spring-web MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =4.6.0.0 - ai.apiverse:apipulse 1.0.1 and more Source cves: CVE-2024-38820 Source advisory: MEND:CVE-2024-38820...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.2.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +8132 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (>=6.1.0, <=6.1.13)

org.springframework:spring-web MAVEN version =6.1.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.5.0, =0.6.0, =0.6.0, =0.5.0, =0.6.0, =0.6.0, =0.5.0, =0.9.1, =0.7.0, =0.9.2 and more Source cves: CVE-2024-38820 Source advisory: MEND:CVE-2024-38820...

org.springframework:spring-web: Spring Framework DoS via conditional HTTP request

A flaw was found in the Spring Web org.springframework:spring-web package. Due to improper ETag prefix validation when the application parses ETags from the If-Match or If-None-Match request headers, an attacker can trigger a denial of service by sending a maliciously crafted conditional HTTP...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.2.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.70.0, <=0.74.0) +7230 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (>=6.1.0, <=6.1.11)

org.springframework:spring-web MAVEN version =6.1.0, =0.70.0, =0.1.0, =0.5.0, =0.6.0, =0.6.0, =0.5.0, =0.6.0, =0.6.0, =0.5.0, =0.9.1, =0.7.0, =0.7.0, =0.9.2 and more Source cves: CVE-2024-38809 Source advisory: MEND:CVE-2024-38809...

Denial Of Service (DoS)

org.springframework,spring-web is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of ETags from If-Match or If-None-Match request headers, allowing attackers to overwhelm the system and cause service disruption...

CVE-2024-38809

A flaw was found in the Spring Web org.springframework:spring-web package. Due to improper ETag prefix validation when the application parses ETags from the If-Match or If-None-Match request headers, an attacker can trigger a denial of service by sending a maliciously crafted conditional HTTP...

cn.fastoo:fastoo-java-api (20171130), com.github.lynzabo.codegen:codegen-test (1.0-release) +47 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (2.5.4)

org.springframework:spring-web MAVEN version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - cn.fastoo:fastoo-java-api 20171130 - com.github.lynzabo.codegen:codegen-test 1.0-release -...

ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone (>=0.7, <=0.8), ch.rasc:sse-eventbus (1.1.6) +785 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.3.14.release)

org.springframework:spring-web MAVEN version 4.3.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone =0.7, =0.1.6-v1, =1.0.1, =2.0.0 and...

cn.deepbit:deepbit-sdk (8.3.7), cn.deepbit:deepbit-start-mvc (8.3.7) +285 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.3.23.release)

org.springframework:spring-web MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - cn.deepbit:deepbit-sdk 8.3.7 - cn.deepbit:deepbit-start-mvc 8.3.7 -...

au.com.mountain-pass:hyperstate (>=4, <=9), ch.sbb.releasetrain:action (>=0.0.21, <=0.0.22) +618 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.2.6.release)

org.springframework:spring-web MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - au.com.mountain-pass:hyperstate =4, =0.0.21, =0.0.21, =0.0.21, =0.0.21, =0.0.21, =0.0.21,...

com.bekk.boss:maven-jetty-pluto-embedded (1.0), com.google.code.struts2webflow:struts2webflow-parent (1.0.4) +11 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (2.0.1)

org.springframework:spring-web MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.bekk.boss:maven-jetty-pluto-embedded 1.0 - com.google.code.struts2webflow:struts2webflow-parent...

club.trandiscuss:api-doc-gen (0.1), cn.com.365trade.oss:xxl-job-admin (>=2.2.1_zzlh, <=2.2.1.1_zzlh) +421 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.3.25.release)

org.springframework:spring-web MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - club.trandiscuss:api-doc-gen 0.1 - cn.com.365trade.oss:xxl-job-admin =2.2.1zzlh, =1.4.2,...

org.springframework:spring-hibernate (1.2.3), org.springframework:spring-mock (1.2.3) +3 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (1.2.3)

org.springframework:spring-web MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.3 - org.springframework:spring-mock 1.2.3 -...

at.chrl:chrl-orm-spring-integration (1.1.0), com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.0.120-release) +192 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.2.1.release)

org.springframework:spring-web MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - at.chrl:chrl-orm-spring-integration 1.1.0 - com.ahome-it:ahome-tooling-server-core...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +420 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.2.3.release)

org.springframework:spring-web MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter =0.1.6, =0.1.4-sb1x,...

cc.ecore:spring-jfinal (0.0.1), com.foreach.across.modules:spring-mobile-module (>=3.0.0.release, <=3.1.0.release) +83 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (3.2.13.release)

org.springframework:spring-web MAVEN version 3.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - cc.ecore:spring-jfinal 0.0.1 - com.foreach.across.modules:spring-mobile-module...

com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (>=2.1.0, <=2.3.0), com.github.downgoon:jresty-rest (0.0.1) +802 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (2.5.6)

org.springframework:spring-web MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.amashchenko.struts2.actionflow:struts2-actionflow-showcase =2.1.0, =1.0.1, =0.1.0, =0.1.4,...

ba.jamax.util:jamax-rest (>=1.3.1-release, <=1.3.4-release), biz.dfch.j:activiti.wrapper (>=0.0.6, <=0.0.7) +651 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.1.6.release)

org.springframework:spring-web MAVEN version 4.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ba.jamax.util:jamax-rest =1.3.1-release, =0.0.6, =0.1.0, =0.1.5, =0.4.0, =0.4.0, =1.0.83-rc...

com.erigir:wrench-shiro-oauth (>=0.6, <=0.9), com.github.cafdataprocessing:boilerplate-api-web (>=2.0.0-5, <=2.3.0-92) +200 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.0.5.release)

org.springframework:spring-web MAVEN version 4.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.erigir:wrench-shiro-oauth =0.6, =2.0.0-5, =1.0.0-4, =2.3.3, =0.1, =1.3, =1.3, =0.1.0,...