Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.springframework/spring-web@5.3.40
purl pkg:maven/org.springframework/spring-web@5.3.40
Tags Ghost
Next non-vulnerable version 6.1.12
Latest non-vulnerable version 6.2.8
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-pzz7-mfs4-rfda
Aliases:
CVE-2024-38820
GHSA-4gc7-5j7h-4qph
Spring Framework DataBinder Case Sensitive Match Exception The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
6.1.14
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T16:06:42.641103+00:00 GHSA Importer Affected by VCID-pzz7-mfs4-rfda https://github.com/advisories/GHSA-4gc7-5j7h-4qph 38.0.0