Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expos

Summary

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

Timeline

1. May 11, 2018, 8:00 PM UTCCVE published
2. Oct 8, 2026, 9:09 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 8, 2026, 9:13 PM UTCRecord last updated

Affected versions

• Pivotal Spring Framework

  5.0.x prior to 5.0.6; 4.3.x prior to 4.3.17

• org.springframework:spring-coreMaven

  From 5.0.0 · fixed in 5.0.6

• org.springframework:spring-coreMaven

  fixed in 4.3.17

References 11