Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a De

Summary

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.

Timeline

1. Jun 29, 2021, 4:15 PM UTCCVE published
2. Aug 3, 2024, 6:30 PM UTCRecord last updated

Affected versions

• n/a Spring Security

  Version range not reported

• org.springframework.security:spring-security-coreMaven

  From 5.5.0 · fixed in 5.5.1

• org.springframework.security:spring-security-coreMaven

  From 5.4.0 · fixed in 5.4.7

• org.springframework.security:spring-security-coreMaven

  From 5.3.0 · fixed in 5.3.10

• org.springframework.security:spring-security-coreMaven

  From 5.2.0 · fixed in 5.2.11

• org.springframework.security:spring-security-oauth2-clientMaven

  From 5.5.0 · fixed in 5.5.1

• org.springframework.security:spring-security-oauth2-clientMaven

  From 5.4.0 · fixed in 5.4.7

• org.springframework.security:spring-security-oauth2-clientMaven

  From 5.3.0 · fixed in 5.3.10

• org.springframework.security:spring-security-oauth2-clientMaven

  From 5.2.0 · fixed in 5.2.11

References 10