-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework:spring-expression | maven | >= 6.0.0, < 6.0.8 | 6.0.8 |
| org.springframework:spring-expression | maven | >= 5.3.0, < 5.3.27 | 5.3.27 |
| org.springframework:spring-expression | maven | < 5.2.24.RELEASE | 5.2.24.RELEASE |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing length checks during SpEL expression parsing. The patch introduced a 'checkExpressionLength' method and 'MAX_EXPRESSION_LENGTH' constant to address this. The 'doParseExpression' method was vulnerable because it processed untrusted input without these safeguards, enabling DoS via crafted long expressions. The commit diff clearly shows these security controls were added to this specific parser function.
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report