CVE-2024-38809

Name of the Vulnerable Software and Affected Versions: org.springframework:spring-web versions 5.3.0 through 5.3.37 org.springframework:spring-web versions 6.0.0 through 6.0.22 org.springframework:spring-web versions 6.1.0 through 6.1.11

Description: Applications that parse ETags from If-Match or If-None-Match request headers are vulnerable to a denial-of-service (DoS) attack. The issue is related to errors in resource release.

Recommendations: For versions 5.3.x, upgrade to version 5.3.38. For versions 6.0.x, upgrade to version 6.0.23. For versions 6.1.x, upgrade to version 6.1.12. For older, unsupported versions, enforce a size limit on If-Match and If-None-Match headers, e.g., through a Filter.