org.springframework:spring-beans 6.1.15

Direct Vulnerabilities

Known vulnerabilities in the org.springframework:spring-beans package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data binding. An attacker can exhaust system memory by supplying a crafted property path with a large index value, causing unbounded allocation of list elements when the target object contains a self-populating list whose element type exposes sub-properties. Note: This is only exploitable if the application uses Spring's data binding infrastructure to apply user-supplied property paths onto a target object, the target object contains a self-populating list implementation as a property, and the list's element type exposes sub-properties. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework:spring-beans` to version 7.0.9 or higher.	[,7.0.9)
H Relative Path Traversal org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Relative Path Traversal when deployed on non-compliant Servlet containers. An unauthenticated attacker could gain access to files and directories outside the intended web root. Notes: This is only exploitable if the application is deployed as a WAR or with an embedded Servlet container, the Servlet container does not reject suspicious sequences and the application serves static resources with Spring resource handling. Applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. This vulnerability was also fixed in the commercial versions 6.1.22 and 5.3.44. How to fix Relative Path Traversal? Upgrade `org.springframework:spring-beans` to version 6.2.10 or higher.	[,6.2.10)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data binding. An attacker can exhaust system memory by supplying a crafted property path with a large index value, causing unbounded allocation of list elements when the target object contains a self-populating list whose element type exposes sub-properties.

Note: This is only exploitable if the application uses Spring's data binding infrastructure to apply user-supplied property paths onto a target object, the target object contains a self-populating list implementation as a property, and the list's element type exposes sub-properties.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework:spring-beans to version 7.0.9 or higher.

[,7.0.9)

Relative Path Traversal

Affected versions of this package are vulnerable to Relative Path Traversal when deployed on non-compliant Servlet containers. An unauthenticated attacker could gain access to files and directories outside the intended web root.

Notes:

This is only exploitable if the application is deployed as a WAR or with an embedded Servlet container, the Servlet container does not reject suspicious sequences and the application serves static resources with Spring resource handling.
Applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration.
This vulnerability was also fixed in the commercial versions 6.1.22 and 5.3.44.

How to fix Relative Path Traversal?

Upgrade org.springframework:spring-beans to version 6.2.10 or higher.

[,6.2.10)

org.springframework:spring-beans@6.1.15

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically