Denial Of Service (DoS)

2023-04-1807:02:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

denial of service

dos

spring expression language

vulnerability

internalspelexpressionparser.java

application crash

security

0.003 Low

EPSS

Percentile

70.0%

JSON

Spring Expression Language is vulnerable to Denial Of Service (DoS). The vulnerability exists in the doParseExpression function of InternalSpelExpressionParser.java because the SpEL expression length is not restricted which allows an attacker to cause an application crash.

CPENameOperatorVersion
spring expression language (spel)le5.2.23.RELEASE
spring expression language (spel)le3.0.7.RELEASE
spring expression language (spel)le5.3.26
spring expression language (spel)le6.0.7
spring expression language (spel)le4.1.9.RELEASE
spring expression language (spel)le4.0.9.RELEASE
spring expression language (spel)le3.2.18.RELEASE
spring expression language (spel)le5.0.20.RELEASE
spring expression language (spel)le4.3.30.RELEASE
spring expression language (spel)le4.2.9.RELEASE

Name	Operator	Version
spring expression language (spel)	le	5.2.23.RELEASE
spring expression language (spel)	le	3.0.7.RELEASE
spring expression language (spel)	le	5.3.26
spring expression language (spel)	le	6.0.7
spring expression language (spel)	le	4.1.9.RELEASE
spring expression language (spel)	le	4.0.9.RELEASE
spring expression language (spel)	le	3.2.18.RELEASE
spring expression language (spel)	le	5.0.20.RELEASE
spring expression language (spel)	le	4.3.30.RELEASE
spring expression language (spel)	le	4.2.9.RELEASE