CVE-2018-1257
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
Risk Assessment
An attacker can send a specially crafted STOMP message, causing excessive CPU consumption via regular expressions and resulting in denial of service.
Recommendation
Update Spring Framework to version 5.0.6, 4.3.17, or later.
Other vulnerabilities in Spring Framework
See all- CVE-2014-0225High
The Spring Framework versions from 4.0.0 to 4.0.4 and from 3.0.0 to 3.2.8, as well as possibly earlier unsupported versions, did not disable by default the resolution of URI references in a DTD declaration when processing user-provided XML documents. This enabled an XXE attack.
- CVE-2026-59313Critical
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Affects Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, and 5.3.0-5.3.49.
- CVE-2026-59283Critical
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Affects multiple versions of Spring Framework.
- CVE-2026-47892Critical
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.5.RELEASE-5.2.25.RELEASE.
- CVE-2026-47891Critical
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.
- CVE-2026-47890Critical
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Affected versions: Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19.
- CVE-2022-22968Medium
In Spring Framework versions 5.3.0-5.3.18, 5.2.0-5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
- CVE-2022-22965CriticalActively exploited
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment; applications deployed as Spring Boot executable jars are not vulnerable to this specific exploit, but the vulnerability is more general in nature.
- CVE-2022-22950Medium
In Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
- CVE-2020-5421Medium
In Spring Framework versions 5.2.0-5.2.8, 5.1.0-5.1.17, 5.0.0-5.0.18, 4.3.0-4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Original NVD description (English source)
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS