CVE-2024-38828 Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack

Description

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Affected products and versions

Product	Affected versions	Fixed in
Spring 5.3	5.3.x → < 5.3.42	5.3.42
Spring 5.3	5.3.0 → < 5.3.42	5.3.42

Other CVEs of Spring

The 4 CVEs of Spring →

CVE-2024-38821 Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under… 9.1 Critical CVE-2024-38816 Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to… 7.5 High CVE-2024-22258 Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are… 6.1 Medium