Spring Framework Denial-of-Service Vulnerability in Static Resource Handling on Windows

A denial-of-service vulnerability has been identified in Spring MVC and WebFlux applications that serve static resources from the file system on Windows platforms. Under these conditions, an attacker can send malicious requests that are slow to process, keeping HTTP connections active and potentially causing a denial-of-service condition on the application.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the application to become unresponsive or slow down significantly.

Remediation

Users of affected versions should upgrade to the fixed version. For Spring Framework 7.0.x, upgrade to 7.0.7; for 6.2.x, upgrade to 6.2.18; for 6.1.x, upgrade to 6.1.27; and for 5.3.x, upgrade to 5.3.48.