GHSA-w9jg-gvgr-354mHighCVSS 7.5

Resource Exhaustion in Spring Security

Published
July 2, 2021
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-22119 →

📋 Description

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.

🎯 Affected products8

  • maven/org.springframework.security:spring-security-core:>= 5.5.0, < 5.5.1
  • maven/org.springframework.security:spring-security-core:>= 5.4.0, < 5.4.7
  • maven/org.springframework.security:spring-security-oauth2-client:>= 5.5.0, < 5.5.1
  • maven/org.springframework.security:spring-security-oauth2-client:>= 5.4.0, < 5.4.7
  • maven/org.springframework.security:spring-security-core:>= 5.3.0, <= 5.3.9
  • maven/org.springframework.security:spring-security-core:>= 5.2.0, <= 5.2.10
  • maven/org.springframework.security:spring-security-oauth2-client:>= 5.3.0, <= 5.3.9
  • maven/org.springframework.security:spring-security-oauth2-client:>= 5.2.0, <= 5.2.10

🔗 References (12)