Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fezk-p22c-dyan
Vulnerability ID VCID-fezk-p22c-dyan
Aliases CVE-2024-38808
GHSA-9cmq-m9j5-mvww
Summary In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-400 Uncontrolled Resource Consumption
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38808.json
epss 0.00809 https://api.first.org/data/v1/epss?cve=CVE-2024-38808
epss 0.00809 https://api.first.org/data/v1/epss?cve=CVE-2024-38808
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-9cmq-m9j5-mvww
cvssv3.1 4.3 https://github.com/spring-projects/spring-framework
cvssv4 5.1 https://github.com/spring-projects/spring-framework
generic_textual MODERATE https://github.com/spring-projects/spring-framework
cvssv3.1 4.3 https://github.com/spring-projects/spring-framework/commit/26f2dad388499faecf99e75b8856788e95d8d658
cvssv4 5.1 https://github.com/spring-projects/spring-framework/commit/26f2dad388499faecf99e75b8856788e95d8d658
generic_textual MODERATE https://github.com/spring-projects/spring-framework/commit/26f2dad388499faecf99e75b8856788e95d8d658
cvssv3.1 4.3 https://github.com/spring-projects/spring-framework/commit/f44d13cb7816e586b86c02421af4f5498391111c
cvssv4 5.1 https://github.com/spring-projects/spring-framework/commit/f44d13cb7816e586b86c02421af4f5498391111c
generic_textual MODERATE https://github.com/spring-projects/spring-framework/commit/f44d13cb7816e586b86c02421af4f5498391111c
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2024-38808
cvssv4 5.1 https://nvd.nist.gov/vuln/detail/CVE-2024-38808
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-38808
cvssv3.1 4.3 https://security.netapp.com/advisory/ntap-20240920-0002
cvssv4 5.1 https://security.netapp.com/advisory/ntap-20240920-0002
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20240920-0002
cvssv3.1 4.3 https://spring.io/security/cve-2024-38808
cvssv4 5.1 https://spring.io/security/cve-2024-38808
generic_textual MODERATE https://spring.io/security/cve-2024-38808
ssvc Track https://spring.io/security/cve-2024-38808
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38808.json
https://api.first.org/data/v1/epss?cve=CVE-2024-38808
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38808
https://github.com/spring-projects/spring-framework
https://github.com/spring-projects/spring-framework/commit/26f2dad388499faecf99e75b8856788e95d8d658
https://github.com/spring-projects/spring-framework/commit/f44d13cb7816e586b86c02421af4f5498391111c
https://security.netapp.com/advisory/ntap-20240920-0002
2305959 https://bugzilla.redhat.com/show_bug.cgi?id=2305959
cve-2024-38808 https://spring.io/security/cve-2024-38808
CVE-2024-38808 https://nvd.nist.gov/vuln/detail/CVE-2024-38808
GHSA-9cmq-m9j5-mvww https://github.com/advisories/GHSA-9cmq-m9j5-mvww
RHSA-2024:6508 https://access.redhat.com/errata/RHSA-2024:6508
RHSA-2024:8884 https://access.redhat.com/errata/RHSA-2024:8884
RHSA-2024:8885 https://access.redhat.com/errata/RHSA-2024:8885
RHSA-2024:8886 https://access.redhat.com/errata/RHSA-2024:8886
RHSA-2024:8887 https://access.redhat.com/errata/RHSA-2024:8887
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38808.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://github.com/spring-projects/spring-framework
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://github.com/spring-projects/spring-framework
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://github.com/spring-projects/spring-framework/commit/26f2dad388499faecf99e75b8856788e95d8d658
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://github.com/spring-projects/spring-framework/commit/26f2dad388499faecf99e75b8856788e95d8d658
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://github.com/spring-projects/spring-framework/commit/f44d13cb7816e586b86c02421af4f5498391111c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://github.com/spring-projects/spring-framework/commit/f44d13cb7816e586b86c02421af4f5498391111c
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-38808
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-38808
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://security.netapp.com/advisory/ntap-20240920-0002
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://security.netapp.com/advisory/ntap-20240920-0002
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://spring.io/security/cve-2024-38808
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://spring.io/security/cve-2024-38808
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-20T13:48:27Z/ Found at https://spring.io/security/cve-2024-38808
Exploit Prediction Scoring System (EPSS)
Percentile 0.74652
EPSS Score 0.00809
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:30:20.296663+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/38xxx/CVE-2024-38808.json 38.6.0