CVE-2023-20883
Spring Boot Welcome Page Denial of Service
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
- Record
CVE-2023-20883- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
- Record
CVE-2023-20883- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2023-1651
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
- Record
EUVD-2023-1651- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xf96-w227-r7c4
Spring Boot Welcome Page Denial of Service
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Specifically, an application is vulnerable if all of the conditions are true:
- The application has Spring MVC auto-configuration enabled. This is the case by default if Spring MVC is on the classpath.
- The application makes use of Spring Boot's welcome page support, either static or templated.
- Your application is deployed behind a proxy which caches 404 responses.
Your application is NOT vulnerable if any of the following are true:
- Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfiguration is explicitly excluded, if Spring MVC is not on the classpath, or if spring.main.web-application-type is set to a value other than SERVLET.
- The application does not use Spring Boot's welcome page support.
- You do not have a proxy which caches 404 responses.
Affected Spring Products and Versions
Spring Boot
3.0.0 to 3.0.6 2.7.0 to 2.7.11 2.6.0 to 2.6.14 2.5.0 to 2.5.14
Older, unsupported versions are also affected Mitigation
Users of affected versions should apply the following mitigations:
- 3.0.x users should upgrade to 3.0.7+
- 2.7.x users should upgrade to 2.7.12+
- 2.6.x users should upgrade to 2.6.15+
- 2.5.x users should upgrade to 2.5.15+
Users of older, unsupported versions should upgrade to 3.0.7+ or 2.7.12+.
Workarounds: configure the reverse proxy not to cache 404 responses and/or not to cache responses to requests to the root (/) of the application.
- Record
GHSA-xf96-w227-r7c4- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
- Record
CVE-2023-20883- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-xf96-w227-r7c4
Spring Boot Welcome Page Denial of Service
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Specifically, an application is vulnerable if all of the conditions are true:
- The application has Spring MVC auto-configuration enabled. This is the case by default if Spring MVC is on the classpath.
- The application makes use of Spring Boot's welcome page support, either static or templated.
- Your application is deployed behind a proxy which caches 404 responses.
Your application is NOT vulnerable if any of the following are true:
- Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfiguration is explicitly excluded, if Spring MVC is not on the classpath, or if spring.main.web-application-type is set to a value other than SERVLET.
- The application does not use Spring Boot's welcome page support.
- You do not have a proxy which caches 404 responses.
Affected Spring Products and Versions
Spring Boot
3.0.0 to 3.0.6 2.7.0 to 2.7.11 2.6.0 to 2.6.14 2.5.0 to 2.5.14
Older, unsupported versions are also affected Mitigation
Users of affected versions should apply the following mitigations:
- 3.0.x users should upgrade to 3.0.7+
- 2.7.x users should upgrade to 2.7.12+
- 2.6.x users should upgrade to 2.6.15+
- 2.5.x users should upgrade to 2.5.15+
Users of older, unsupported versions should upgrade to 3.0.7+ or 2.7.12+.
Workarounds: configure the reverse proxy not to cache 404 responses and/or not to cache responses to requests to the root (/) of the application.
- Record
GHSA-xf96-w227-r7c4- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Show 6 moreShow less
OSVROOT-APP-MAVEN-CVE-2023-20883
CVE-2023-20883 in org.springframework.boot:spring-boot-autoconfigure - Patched by Root
Root has patched CVE-2023-20883 in the org.springframework.boot:spring-boot-autoconfigure package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2023-20883- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1752019358 No score
TuxCare security update for org.springframework.boot (5 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 5 CVEs. Fixed in 2.4.6.tuxcare.2.
- Record
CLSA-2025-1752019358- Updated
- 2026-11-02
OSVCLSA-2026-1774916753 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.1.
- Record
CLSA-2026-1774916753- Updated
- 2026-11-02
OSVCLSA-2026-1779929353 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.5-tuxcare.1.
- Record
CLSA-2026-1779929353- Updated
- 2026-11-02
OSVCLSA-2026-1783991067 No score
TuxCare security update for org.springframework.boot (9 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 9 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1783991067- Updated
- 2026-11-02
OSVCLSA-2026-1793299405 No score
TuxCare security update for org.springframework.boot (8 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.9-tuxcare.1.
- Record
CLSA-2026-1793299405- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-autoconfigureMaven |
3.0.0 up to 3.0.7 | 3.0.7 |
org.springframework.boot:spring-boot-autoconfigureMaven |
2.7.0 up to 2.7.12 | 2.7.12 |
org.springframework.boot:spring-boot-autoconfigureMaven |
2.6.0 up to 2.6.15 | 2.6.15 |
org.springframework.boot:spring-boot-autoconfigureMaven |
before 2.5.15 | 2.5.15 |
org.springframework.boot:spring-bootTuxCare:Maven |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-starter-webTuxCare:Maven |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-starter-webfluxTuxCare:Maven |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.1 | 2.3.6.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.1 | 2.3.6.RELEASE-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureMaven |
3.0.0 up to 3.0.7, plus listed versions 3.0.13.0.23.0.33.0.43.0.53.0.6 |
3.0.7 |
org.springframework.boot:spring-boot-autoconfigureMaven |
2.7.0 up to 2.7.12, plus listed versions 2.7.12.7.102.7.112.7.22.7.3 Show 6 moreShow less2.7.42.7.52.7.62.7.72.7.82.7.9 |
2.7.12 |
org.springframework.boot:spring-boot-autoconfigureMaven |
2.6.0 up to 2.6.15, plus listed versions 2.6.12.6.102.6.112.6.122.6.13 Show 9 moreShow less2.6.142.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.9 |
2.6.15 |
org.springframework.boot:spring-boot-autoconfigureMaven |
before 2.5.15, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE |
2.5.15 |
org.springframework.boot:spring-boot-autoconfigureRoot:Maven |
before 2.7.11-aikido.2 | 2.7.11-aikido.22.7.4-aikido.22.7.0-aikido.2 |
io.root.org.springframework.boot:spring-boot-autoconfigureRoot:Maven |
before 2.7.11-root.io.2 | 2.7.11-root.io.22.7.0-root.io.12.7.4-root.io.12.7.4-root.io.22.7.0-root.io.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-20883 is a high vulnerability (CVSS 7.5) in Spring Boot, published May 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in org.springframework.boot:spring-boot-autoconfigure 3.0.7.
References
spring.io/security/cve-2023-20883
security.netapp.com/advisory/ntap-20230703-0008
nvd.nist.gov/vuln/detail/CVE-2023-20883
github.com/spring-projects/spring-boot/issues/35552
Left out here: 100 versions. The JSON record has them.