Spring Framework DoS via conditional HTTP request (CVE-2024-38809)

Spring Framework DoS via conditional HTTP request (CVE-2024-38809) | HOL Guard CVE

Why this deserves its current priority

CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps org.springframework:spring-web (maven), org.springframework:spring-web (maven), org.springframework:spring-web (maven). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
org.springframework:spring-webmaven	>=0 <5.3.38	5.3.38
org.springframework:spring-webmaven	>=6.0.0 <6.0.23	6.0.23
org.springframework:spring-webmaven	>=6.1.0 <6.1.12	6.1.12

Recommended response

Check inventory. Check lockfiles and deployed manifests for org.springframework:spring-web, org.springframework:spring-web, org.springframework:spring-web.
Review the reported fix. Update org.springframework:spring-web to 5.3.38; org.springframework:spring-web to 6.0.23; org.springframework:spring-web to 6.1.12 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 24, 2024
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

### Description Applications that parse ETags from `If-Match` or `If-None-Match` request headers are vulnerable to DoS attack. ### Affected Spring Products and Versions org.springframework:spring-web in versions 6.1.0 through 6.1.11 6.0.0 through 6.0.22 5.3.0 through 5.3.37 Older, unsupported versions are also affected ### Mitigation Users of affected versions should upgrade to the corresponding fixed version. 6.1.x -> 6.1.12 6.0.x -> 6.0.23 5.3.x -> 5.3.38 No other mitigation steps are necessary. Users of older, unsupported versions could enforce a size limit on `If-Match` and `If-None-Match` headers, e.g. through a Filter.

Quoted source text, attributed separately from HOL analysis.