New Expression DoS Vulnerability Found in Spring (CVE-2023-20861)

Posted by Password2 on Thursday March 23, 2023 @10:16AM
from the code-intelligence.com dept.

https://www.code-intelligence.com/blog/expression-dos-spring

( 1 comment | on HN )

Re:New Expression DoS Vulnerability Found in Spring (CVE-202... by Password2 on Thursday March 23, 2023 @10:16AM (#35275163)

Mitigation: Fixes have already been released. These include adding limit checks for the effective size of repeated text as well as the length of a regular expression supplied to the matches operator.

Users of affected versions should upgrade to a new version that contains the fixes:

6.0.x users should upgrade to 6.0.7+. 5.3.x users should upgrade to 5.3.26+. 5.2.x users should upgrade to 5.2.23.RELEASE+.

[ Parent | on HN ]