CVE-2018-1270

CVE-2018-1270 - Spring messaging SpEL Code Execution Vulnerability Gestern hat Spring einen RCE-Schwachstelle veröffentlicht, mehr dazu: CVE-2018-1270: Remote Code Execution with spring-messaging Betroffene Versionen Spring Framework 5.0 bis 5.0.4 Spring Framework 4.3 bis 4.3.14 Diese Schwachstel...

Missing Release of Resource after Effective Lifetime

Overview org.springframework:spring-messaging is a framework and inversion of control container for the Java platform. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the RSocketMessageHandler process when handling a malformed SETUP...

CVE-2026-41714

Spring AMQP 2.4.x/3.1.x/3.2.x/4.0.x (versions 2.4.0–2.4.17, 3.1.0–3.1.15, 3.2.0–3.2.10, 4.0.0–4.0.3) are affected by CVE-2026-41714. The issue occurs when a broker connection is configured via RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true). This leads to TLS enc...

A Bootiful Podcast: Spring Messaging Legend Soby Chacko

Hi, Spring fans! In this installment, we talk with the legendary Soby Chacko about Apache Kafka, Spring AI, and much more! apachekafka kafka...

SUSE CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

Denial Of Service (DoS)

spring-messaging is vulnerable to denial of service. The vulnerability exists because the handleMessageInternal function of SimpleBrokerMessageHandler.java does not properly handle to ignore the invalid STOMP frames, allowing an attacker to cause an application crash through the WebSocket endpoin...

The vulnerability of the spring-messaging module of the Spring Framework allows a perpetrator to execute arbitrary code.

The vulnerability of the spring-messaging module in the Spring Framework is caused by errors in the handling of STOMP messages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted message...

spring-framework: ReDoS Attack with spring-messaging

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...

Denial of Service in org.springframework:spring-core

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...

The vulnerability of the spring-messaging module in the Spring Framework software platform allows a hacker to gain full control over the application.

The vulnerability of the spring-messaging module in the Spring Framework is caused by errors in the handling of STOMP messages. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain full control over the application through a specially crafted message...

CVE-2018-1257

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...

CVE-2018-1257: Undefined Security Weakness

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...

Regular Expression Denial Of Service (ReDoS)

spring-messaging is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a message to an in-memory STOMP broker that can cause a ReDoS...

PT-2018-2768

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.0.x prior to 5.0.6 Spring Framework versions 4.3.x prior to 4.3.17 Spring Framework older unsupported versions Description The issue exists due to insufficient input validation in the Spring Framework. This can be...

Spring Framework Spring-messaging Remote Code Execution Vulnerability

Spring Framework is the U.S. Pivotal Software's set of open source Java, Java EE application framework. The framework helps developers build high-quality applications . A remote code execution vulnerability exists in Spring Framework Spring-messaging. An attacker can exploit the vulnerability to...

CVE-2018-1275

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

CVE-2018-1275

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

CVE-2018-1275: Improper Control of Generation of Code

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

PT-2018-1390

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.0 prior to 5.0.5 Spring Framework versions 4.3 prior to 4.3.16 Spring Framework older unsupported versions Description The issue allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory...

Remote Code Execution Vulnerability in Spring Framework spring-messaging Module

Spring Framework is the United States Pivotal Software's set of open source Java, Java EE application framework. The framework helps developers build high-quality applications . A remote code execution vulnerability exists in the Spring Framework spring-messaging module. An attacker can exploit t...