CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-41234 – RFD Attack via “Content-Disposition” Header Sourced from Request
https://notcve.org/view.php?id=CVE-2025-41234
12 Jun 2025 — Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an application is vulnerable when all the following are true: * The header is prepared with org.springframework.http.ContentDisposition. * The filename is set via ContentDisposition.Builder#filename(Strin... • https://spring.io/security/cve-2025-41234 • CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') •
CVSS: 3.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-22233 – Spring Framework DataBinder Case Sensitive Match Exception
https://notcve.org/view.php?id=CVE-2025-22233
16 May 2025 — CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Older, unsupported versions are also affected Mitigation Users of affected versions should upgrade to the corresponding fixed version. Affected versi... • https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N&version=3.1 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 0CVE-2024-22233 – CVE-2024-22233: Spring Framework server Web DoS Vulnerability
https://notcve.org/view.php?id=CVE-2024-22233
22 Jan 2024 — In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC * Spring Security 6.1.6+ or 6.2.1+ is on the classpath Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all... • https://security.netapp.com/advisory/ntap-20240614-0005 • CWE-400: Uncontrolled Resource Consumption •