← All advisories

Medium severity5.3GHSA Advisory· Published Nov 18, 2024· Updated Apr 15, 2026

CVE-2024-38828

CVE-2024-38828

Description

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.springframework:spring-webmvcMaven	>= 5.3.0, < 5.3.42	5.3.42

Affected products

15

Spring Projects/FrameworkGHSA
Range: >= 5.3.0, < 5.3.42
osv-coords14 versions
pkg:apk/chainguard/geoserver-2.26-community pkg:apk/chainguard/geoserver-2.26-docker pkg:apk/chainguard/geoserver-2.27-community pkg:apk/chainguard/geoserver-2.27-docker pkg:apk/chainguard/geoserver-2.28-community pkg:apk/chainguard/geoserver-2.28-docker pkg:apk/chainguard/seata pkg:apk/chainguard/seata-namingserver-oci-entrypoint pkg:apk/chainguard/seata-openjdk-17-compat pkg:apk/chainguard/seata-openjdk-21-compat pkg:apk/chainguard/seata-openjdk-8-compat pkg:apk/chainguard/seata-server pkg:apk/chainguard/seata-server-oci-entrypoint pkg:maven/org.springframework/spring-webmvc
< 2.26.4-r0+ 13 more
- (no CPE)range: < 2.26.4-r0
- (no CPE)range: < 2.26.4-r0
- (no CPE)range: < 2.27.3-r0
- (no CPE)range: < 2.27.3-r0
- (no CPE)range: < 2.28.1-r1
- (no CPE)range: < 2.28.1-r1
- (no CPE)range: < 2.5.0-r3
- (no CPE)range: < 2.5.0-r3
- (no CPE)range: < 2.5.0-r3
- (no CPE)range: < 2.5.0-r3
- (no CPE)range: < 2.5.0-r3
- (no CPE)range: < 2.5.0-r3
- (no CPE)range: < 2.5.0-r3
- (no CPE)range: >= 5.3.0, < 5.3.42

Patches

Vulnerability mechanics

References

5

github.com/advisories/GHSA-w3c8-7r8f-9jp8ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-38828ghsaADVISORY
security.netapp.com/advisory/ntap-20250509-0009ghsaWEB
spring.io/security/cve-2024-38828nvdWEB
security.netapp.com/advisory/ntap-20250509-0009/nvd

News mentions

0

No linked articles in our index yet.