CVE-2023-34055
Spring Boot server Web Observations DoS Vulnerability
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
- org.springframework.boot:spring-boot-actuator is on the classpath
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Spring Boot server Web Observations DoS Vulnerability
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
- org.springframework.boot:spring-boot-actuator is on the classpath
- Record
CVE-2023-34055- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
EUVDEUVD-2023-2990
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
- org.springframework.boot:spring-boot-actuator is on the classpath
- Record
EUVD-2023-2990- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jjfh-589g-3hjx
Spring Boot Actuator denial of service vulnerability
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
org.springframework.boot:spring-boot-actuatoris on the classpath
- Record
GHSA-jjfh-589g-3hjx- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
NVD
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
- org.springframework.boot:spring-boot-actuator is on the classpath
- Record
CVE-2023-34055- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Spring Boot server Web Observations DoS Vulnerability
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
- org.springframework.boot:spring-boot-actuator is on the classpath
- Record
CVE-2023-34055- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-jjfh-589g-3hjx
Spring Boot Actuator denial of service vulnerability
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
org.springframework.boot:spring-boot-actuatoris on the classpath
- Record
GHSA-jjfh-589g-3hjx- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 10 moreShow less
OSVCLSA-2025-1752019358 No score
TuxCare security update for org.springframework.boot (5 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 5 CVEs. Fixed in 2.4.6.tuxcare.2.
- Record
CLSA-2025-1752019358- Updated
- 2026-11-02
OSVCLSA-2026-1769472532 No score
TuxCare security update for org.springframework.boot:spring-boot-actuator (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-actuator to address 1 CVE. Fixed in 2.6.15-tuxcare.5.
- Record
CLSA-2026-1769472532- Updated
- 2026-11-02
OSVCLSA-2026-1776040413 No score
TuxCare security update for org.springframework.boot:spring-boot-actuator (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-actuator to address 1 CVE. Fixed in 2.3.6.RELEASE-tuxcare.2.
- Record
CLSA-2026-1776040413- Updated
- 2026-11-02
OSVCLSA-2026-1778805965 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 3 CVEs. Fixed in 2.7.16-tuxcare.1.
- Record
CLSA-2026-1778805965- Updated
- 2026-11-02
OSVCLSA-2026-1779929353 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.5-tuxcare.1.
- Record
CLSA-2026-1779929353- Updated
- 2026-11-02
OSVCLSA-2026-1783904634 No score
TuxCare security update for org.springframework.boot (6 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 6 CVEs. Fixed in 2.5.15-tuxcare.1.
- Record
CLSA-2026-1783904634- Updated
- 2026-11-02
OSVCLSA-2026-1783991067 No score
TuxCare security update for org.springframework.boot (9 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 9 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1783991067- Updated
- 2026-11-02
OSVCLSA-2026-1793275461 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.7.7-tuxcare.1.
- Record
CLSA-2026-1793275461- Updated
- 2026-11-02
OSVCLSA-2026-1793283094 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.7.8-tuxcare.1.
- Record
CLSA-2026-1793283094- Updated
- 2026-11-02
OSVCLSA-2026-1793299405 No score
TuxCare security update for org.springframework.boot (8 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.9-tuxcare.1.
- Record
CLSA-2026-1793299405- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-actuatorMaven |
before 2.7.18 | 2.7.18 |
org.springframework.boot:spring-boot-actuatorMaven |
3.0.0 up to 3.0.13 | 3.0.13 |
org.springframework.boot:spring-boot-actuatorMaven |
3.1.0 up to 3.1.6 | 3.1.6 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-starter-webTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-starter-webfluxTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
2.6.15 up to 2.6.15-tuxcare.5, plus listed versions 2.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.42.6.15.tuxcare.1 |
2.6.15-tuxcare.5 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.2, plus listed versions 2.3.6.RELEASE-tuxcare.1 |
2.3.6.RELEASE-tuxcare.2 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 3 CVEs |
2.7.16 up to 2.7.16-tuxcare.1 | 2.7.16-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 3 CVEs |
2.7.16 up to 2.7.16-tuxcare.1 | 2.7.16-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 3 CVEs |
2.7.16 up to 2.7.16-tuxcare.1 | 2.7.16-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 3 CVEs |
2.7.16 up to 2.7.16-tuxcare.1 | 2.7.16-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 2 CVEs |
2.7.7 up to 2.7.7-tuxcare.1 | 2.7.7-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 2 CVEs |
2.7.7 up to 2.7.7-tuxcare.1 | 2.7.7-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 2 CVEs |
2.7.8 up to 2.7.8-tuxcare.1 | 2.7.8-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 2 CVEs |
2.7.8 up to 2.7.8-tuxcare.1 | 2.7.8-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorMaven |
before 2.7.18, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE |
2.7.18 |
org.springframework.boot:spring-boot-actuatorMaven |
3.0.0 up to 3.0.13, plus listed versions 3.0.13.0.103.0.113.0.123.0.2 Show 7 moreShow less3.0.33.0.43.0.53.0.63.0.73.0.83.0.9 |
3.0.13 |
org.springframework.boot:spring-boot-actuatorMaven |
3.1.0 up to 3.1.6, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 |
3.1.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34055 is a medium vulnerability (CVSS 5.3) in Spring Boot, published November 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in org.springframework.boot:spring-boot-actuator 2.7.18.
References
spring.io/security/cve-2023-34055
security.netapp.com/advisory/ntap-20231221-0010
nvd.nist.gov/vuln/detail/CVE-2023-34055
github.com/spring-projects/spring-boot/commit/5490e73922b37a7f0bdde43eb318cb1038b45d60
security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-6226862
Left out here: 135 versions. The JSON record has them.