Overview
About vulnerability
An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).
Affected versions: Spring Framework 5.3.0 through 5.3.48.
Details
- Affected product:
- Apache CXF , Apache Log4j , Apache Struts , Apache Tapestry , Apache Tomcat , Eclipse Jetty , Spring , activemq , camel , castor , cocoon , crash , glassfish-hk2 , gora , grails-core , grails-gsp , jersey , karaf , tika
- Affected packages:
- grails-gsp @ 6.2.4 (+5759 more)