org.springframework:spring-core 6.2.3

Direct Vulnerabilities

Known vulnerabilities in the org.springframework:spring-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Regular Expression Denial of Service (ReDoS) org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via pattern processing in `AntPathMatcher`. An attacker can cause denial of service by supplying a crafted regular expression pattern to methods such as `match()`, `matchStart()`, or `extractUriTemplateVariables()`, triggering excessive backtracking and CPU consumption during pattern evaluation. Note: This is only exploitable if attacker-controlled input is used directly or indirectly as the pattern argument to one of the affected `AntPathMatcher` methods. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `org.springframework:spring-core` to version 6.0.0, 6.2.19, 7.0.8 or higher.	[5.3.0,6.0.0)[6.1.0-M1,6.2.19)[7.0.0-M1,7.0.8)
M Allocation of Resources Without Limits or Throttling org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via static resource resolution. An attacker can cause denial of service by sending crafted requests that are slow to resolve when accessing file-system-backed static resources, causing HTTP connections to remain occupied and exhausting server resources. Note: This is only exploitable if all the following are true: The application uses Spring MVC or Spring WebFlux. Static resources are served from the file system. The application is running on Windows. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework:spring-core` to version 6.2.18, 7.0.7 or higher.	[,6.2.18)[7.0.0-M1,7.0.7)
H Incorrect Authorization org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities. Affected versions of this package are vulnerable to Incorrect Authorization via the `AnnotationsScanner` and `AnnotatedMethod` class. An attacker can gain unauthorized access to sensitive information by exploiting improper resolution of annotations on methods within type hierarchies that use parameterized supertypes with unbounded generics. Note: This is only exploitable if security annotations are used on methods in generic superclasses or generic interfaces and the `@EnableMethodSecurity` feature is enabled. How to fix Incorrect Authorization? Upgrade `org.springframework:spring-core` to version 6.2.11 or higher.	[,6.2.11)

Vulnerability

Vulnerable Version

Regular Expression Denial of Service (ReDoS)

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via pattern processing in AntPathMatcher. An attacker can cause denial of service by supplying a crafted regular expression pattern to methods such as match(), matchStart(), or extractUriTemplateVariables(), triggering excessive backtracking and CPU consumption during pattern evaluation.

Note: This is only exploitable if attacker-controlled input is used directly or indirectly as the pattern argument to one of the affected AntPathMatcher methods.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade org.springframework:spring-core to version 6.0.0, 6.2.19, 7.0.8 or higher.

[5.3.0,6.0.0)[6.1.0-M1,6.2.19)[7.0.0-M1,7.0.8)

Allocation of Resources Without Limits or Throttling

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via static resource resolution. An attacker can cause denial of service by sending crafted requests that are slow to resolve when accessing file-system-backed static resources, causing HTTP connections to remain occupied and exhausting server resources.

Note: This is only exploitable if all the following are true:

The application uses Spring MVC or Spring WebFlux.
Static resources are served from the file system.
The application is running on Windows.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework:spring-core to version 6.2.18, 7.0.7 or higher.

[,6.2.18)[7.0.0-M1,7.0.7)

Incorrect Authorization

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Incorrect Authorization via the AnnotationsScanner and AnnotatedMethod class. An attacker can gain unauthorized access to sensitive information by exploiting improper resolution of annotations on methods within type hierarchies that use parameterized supertypes with unbounded generics.

Note: This is only exploitable if security annotations are used on methods in generic superclasses or generic interfaces and the @EnableMethodSecurity feature is enabled.

How to fix Incorrect Authorization?

Upgrade org.springframework:spring-core to version 6.2.11 or higher.

[,6.2.11)

org.springframework:spring-core@6.2.3

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically