-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unvalidated HTTP method handling in observation conventions. The patch adds validation against known HTTP methods (via HTTP_METHODS sets) and returns METHOD_UNKNOWN for invalid methods. Before this fix, any arbitrary method string would be processed, creating new metric tags each time. Attackers could send numerous unique invalid methods to exhaust memory via Micrometer's KeyValue allocations, which aligns with the described DoS mechanism. The commit diff and added tests for 'unknown HTTP method exchange' confirm these were the vulnerable code paths.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework:spring-webmvc | maven | >= 6.0.0, < 6.0.14 | 6.0.14 |
Ongoing coverage of React2Shell