CVE-2023-20873
Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
- Record
CVE-2023-20873- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
CVE List
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
- Record
CVE-2023-20873- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2023-1303
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
- Record
EUVD-2023-1303- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g5h3-w546-pj7f
Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
- Record
GHSA-g5h3-w546-pj7f- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
- Record
CVE-2023-20873- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-g5h3-w546-pj7f
Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
- Record
GHSA-g5h3-w546-pj7f- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2025-1752019358 No score
TuxCare security update for org.springframework.boot (5 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 5 CVEs. Fixed in 2.4.6.tuxcare.2.
- Record
CLSA-2025-1752019358- Updated
- 2026-11-02
OSVCLSA-2026-1774916753 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.1.
- Record
CLSA-2026-1774916753- Updated
- 2026-11-02
OSVCLSA-2026-1779929353 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.5-tuxcare.1.
- Record
CLSA-2026-1779929353- Updated
- 2026-11-02
OSVCLSA-2026-1783991067 No score
TuxCare security update for org.springframework.boot (9 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 9 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1783991067- Updated
- 2026-11-02
OSVCLSA-2026-1793299405 No score
TuxCare security update for org.springframework.boot (8 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.9-tuxcare.1.
- Record
CLSA-2026-1793299405- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-actuator-autoconfigureMaven |
3.0.0 up to 3.0.6 | 3.0.6 |
org.springframework.boot:spring-boot-actuator-autoconfigureMaven |
2.7.0 up to 2.7.11 | 2.7.11 |
org.springframework.boot:spring-boot-actuator-autoconfigureMaven |
2.6.0 up to 2.6.15 | 2.6.15 |
org.springframework.boot:spring-boot-actuator-autoconfigureMaven |
before 2.5.15 | 2.5.15 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-starter-webTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-starter-webfluxTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.1 | 2.3.6.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.1 | 2.3.6.RELEASE-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureMaven |
3.0.0 up to 3.0.6, plus listed versions 3.0.13.0.23.0.33.0.43.0.5 |
3.0.6 |
org.springframework.boot:spring-boot-actuator-autoconfigureMaven |
2.7.0 up to 2.7.11, plus listed versions 2.7.12.7.102.7.22.7.32.7.4 Show 5 moreShow less2.7.52.7.62.7.72.7.82.7.9 |
2.7.11 |
org.springframework.boot:spring-boot-actuator-autoconfigureMaven |
2.6.0 up to 2.6.15, plus listed versions 2.6.12.6.102.6.112.6.122.6.13 Show 9 moreShow less2.6.142.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.9 |
2.6.15 |
org.springframework.boot:spring-boot-actuator-autoconfigureMaven |
before 2.5.15, plus listed versions 2.0.0.RELEASE2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE Show 45 moreShow less2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE2.0.9.RELEASE2.1.0.RELEASE2.1.1.RELEASE2.1.10.RELEASE2.1.11.RELEASE2.1.12.RELEASE2.1.13.RELEASE2.1.14.RELEASE2.1.15.RELEASE2.1.16.RELEASE2.1.17.RELEASE2.1.18.RELEASE2.1.2.RELEASE2.1.3.RELEASE2.1.4.RELEASE2.1.5.RELEASE2.1.6.RELEASE2.1.7.RELEASE2.1.8.RELEASE2.1.9.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.2.10.RELEASE2.2.11.RELEASE2.2.12.RELEASE2.2.13.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE2.2.5.RELEASE2.2.6.RELEASE2.2.7.RELEASE2.2.8.RELEASE2.2.9.RELEASE2.3.0.RELEASE2.3.1.RELEASE2.3.10.RELEASE2.3.11.RELEASE2.3.12.RELEASE2.3.2.RELEASE2.3.3.RELEASE |
2.5.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-20873 is a critical vulnerability (CVSS 9.8) in Spring Boot, published April 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in org.springframework.boot:spring-boot-actuator-autoconfigure 3.0.6.
References
spring.io/security/cve-2023-20873
security.netapp.com/advisory/ntap-20230601-0009
nvd.nist.gov/vuln/detail/CVE-2023-20873
github.com/spring-projects/spring-boot/commit/32444fed4b51cc58dc908467f706102d7f0bfc15
Show 7 moreShow less
Left out here: 35 versions. The JSON record has them.