CVE-2024-22271: Spring Cloud Function Framework vulnerable to Denial of Service
In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.
Specifically, an application is vulnerable when all of the following are true:
User is using Spring Cloud Function Web module
Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8
References
- github.com/advisories/GHSA-j4r7-p9fp-w3f3
- github.com/spring-cloud/spring-cloud-function
- github.com/spring-cloud/spring-cloud-function/commit/59fe298b67fcb9249db727a7b3a33612fc7a9f75
- github.com/spring-cloud/spring-cloud-function/issues/1139
- github.com/spring-cloud/spring-cloud-function/releases/tag/v4.1.2
- nvd.nist.gov/vuln/detail/CVE-2024-22271
- spring.io/security/cve-2024-22271
Code Behaviors & Features
Detect and mitigate CVE-2024-22271 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →