CVE-2024-38807
CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader
CVE-2024-38807 is a medium vulnerability (CVSS 6.3) in Spring Boot, published August 23, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in org.springframework.boot:spring-boot-loader 2.7.22.
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
- Record
CVE-2024-38807- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-347, CWE-290
- Updated
- 2026-11-02
EUVDEUVD-2024-2526
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
- Record
EUVD-2024-2526- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7cj3-x93g-gj76
Signature forgery in Spring Boot's Loader
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
- Record
GHSA-7cj3-x93g-gj76- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-290, CWE-347
- Updated
- 2026-11-02
NVD
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
- Record
CVE-2024-38807- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-290, CWE-347
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-38807
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
- Record
DEBIAN-CVE-2024-38807- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-7cj3-x93g-gj76
Signature forgery in Spring Boot's Loader
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
- Record
GHSA-7cj3-x93g-gj76- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-290, CWE-347
- Updated
- 2026-11-02
Show 15 moreShow less
OSVUBUNTU-CVE-2024-38807
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
- Record
UBUNTU-CVE-2024-38807- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2025-1738627240 No score
TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.7.18.tuxcare.4.
- Record
CLSA-2025-1738627240- Updated
- 2026-11-02
OSVCLSA-2026-1770336547 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 2 CVEs. Fixed in 3.1.8-tuxcare.1.
- Record
CLSA-2026-1770336547- Updated
- 2026-11-02
OSVCLSA-2026-1776299674 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 2 CVEs. Fixed in 2.6.15-tuxcare.9.
- Record
CLSA-2026-1776299674- Updated
- 2026-11-02
OSVCLSA-2026-1778460303 No score
TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.3.6.RELEASE-tuxcare.3.
- Record
CLSA-2026-1778460303- Updated
- 2026-11-02
OSVCLSA-2026-1780620670 No score
TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.7.16-tuxcare.5.
- Record
CLSA-2026-1780620670- Updated
- 2026-11-02
OSVCLSA-2026-1783645398 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 5 org.springframework.boot packages to address 3 CVEs. Fixed in 3.0.13-tuxcare.1.
- Record
CLSA-2026-1783645398- Updated
- 2026-11-02
OSVCLSA-2026-1783904634 No score
TuxCare security update for org.springframework.boot (6 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 6 CVEs. Fixed in 2.5.15-tuxcare.1.
- Record
CLSA-2026-1783904634- Updated
- 2026-11-02
OSVCLSA-2026-1783991067 No score
TuxCare security update for org.springframework.boot (9 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 9 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1783991067- Updated
- 2026-11-02
OSVCLSA-2026-1784769561 No score
TuxCare security update for org.springframework.amqp (2 CVEs)
TuxCare rebuilt 7 org.springframework.amqp packages to address 2 CVEs. Fixed in 3.1.8-tuxcare.1.
- Record
CLSA-2026-1784769561- Updated
- 2026-11-02
OSVCLSA-2026-1785291684 No score
TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.4.6-tuxcare.7.
- Record
CLSA-2026-1785291684- Updated
- 2026-11-02
OSVCLSA-2026-1790861577 No score
TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.4.5-tuxcare.5.
- Record
CLSA-2026-1790861577- Updated
- 2026-11-02
OSV No score
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
- Record
CVE-2024-38807- Updated
- 2026-11-02
OSVRHLW-2026-11ab22698dd7c623 No score
Lightwell Security Advisory: spring-boot-loader 2.7.18.rhlw-00004
Red Hat Lightwell has released org.springframework.boot:spring-boot-loader 2.7.18.rhlw-00004 with a backported security fix.
CVE-2024-38807: Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
This patched artifact is a drop-in replacement for org.springframework.boot:spring-boot-loader 2.7.18 from Maven Central.
- Record
RHLW-2026-11ab22698dd7c623- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2024-38807 No score
CVE-2024-38807 in io.root.org.springframework.boot:spring-boot-loader - Patched by Root
Root has patched CVE-2024-38807 in the io.root.org.springframework.boot:spring-boot-loader package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2024-38807- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-loaderMaven |
2.7.0 to 2.7.21 | 2.7.22 |
org.springframework.boot:spring-boot-loader-classicMaven |
2.7.0 to 2.7.21 | 2.7.22 |
org.springframework.boot:spring-boot-loaderMaven |
3.0.0 to 3.0.16 | 3.0.17 |
org.springframework.boot:spring-boot-loader-classicMaven |
3.0.0 to 3.0.16 | 3.0.17 |
org.springframework.boot:spring-boot-loaderMaven |
3.1.0 to 3.1.12 | 3.1.13 |
org.springframework.boot:spring-boot-loader-classicMaven |
3.1.0 to 3.1.12 | 3.1.13 |
org.springframework.boot:spring-boot-loaderMaven |
3.2.0 to 3.2.8 | 3.2.9 |
org.springframework.boot:spring-boot-loader-classicMaven |
3.2.0 to 3.2.8 | 3.2.9 |
org.springframework.boot:spring-boot-loaderMaven |
3.3.0 to 3.3.2 | 3.3.3 |
org.springframework.boot:spring-boot-loader-classicMaven |
3.3.0 to 3.3.2 | 3.3.3 |
Show 56 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
2.7.18 up to 2.7.18.tuxcare.4, plus listed versions 2.7.18.tuxcare2.7.18.tuxcare.12.7.18.tuxcare.22.7.18.tuxcare.3 |
2.7.18.tuxcare.4 |
org.springframework.boot:spring-bootTuxCare:Maven |
3.1.8 up to 3.1.8-tuxcare.1 | 3.1.8-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
3.1.8 up to 3.1.8-tuxcare.1 | 3.1.8-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
3.1.8 up to 3.1.8-tuxcare.1 | 3.1.8-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
2.6.15 up to 2.6.15-tuxcare.9, plus listed versions 2.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.42.6.15-tuxcare.52.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15.tuxcare.1 |
2.6.15-tuxcare.9 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
2.6.15 up to 2.6.15-tuxcare.9, plus listed versions 2.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.42.6.15-tuxcare.52.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15.tuxcare.1 |
2.6.15-tuxcare.9 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven |
2.6.15 up to 2.6.15-tuxcare.9, plus listed versions 2.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.42.6.15-tuxcare.52.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15.tuxcare.1 |
2.6.15-tuxcare.9 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.3, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.2 |
2.3.6.RELEASE-tuxcare.3 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
2.7.16 up to 2.7.16-tuxcare.5, plus listed versions 2.7.16-tuxcare.12.7.16-tuxcare.22.7.16-tuxcare.32.7.16-tuxcare.4 |
2.7.16-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
2.4.6 up to 2.4.6-tuxcare.7, plus listed versions 2.4.6-tuxcare.32.4.6-tuxcare.42.4.6-tuxcare.52.4.6-tuxcare.62.4.6.tuxcare.2 |
2.4.6-tuxcare.7 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven |
2.4.5 up to 2.4.5-tuxcare.5, plus listed versions 2.4.5-tuxcare.12.4.5-tuxcare.22.4.5-tuxcare.32.4.5-tuxcare.4 |
2.4.5-tuxcare.5 |
libspring-javaDebian:12 |
All versions, plus listed versions 4.3.30-24.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1 |
None known |
libspring-javaDebian:13 |
All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1 |
None known |
libspring-javaDebian:14 |
All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1 |
None known |
org.springframework.boot:spring-boot-loaderMaven |
2.7.0 up to 2.7.22, plus listed versions 2.7.12.7.102.7.112.7.122.7.13 Show 13 moreShow less2.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.9 |
2.7.22 |
org.springframework.boot:spring-boot-loader-classicMaven |
2.7.0 up to 2.7.22 | 2.7.22 |
org.springframework.boot:spring-boot-loaderMaven |
3.0.0 up to 3.0.17, plus listed versions 3.0.13.0.103.0.113.0.123.0.13 Show 8 moreShow less3.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.9 |
3.0.17 |
org.springframework.boot:spring-boot-loader-classicMaven |
3.0.0 up to 3.0.17 | 3.0.17 |
org.springframework.boot:spring-boot-loaderMaven |
3.1.0 up to 3.1.13, plus listed versions 3.1.13.1.103.1.113.1.123.1.2 Show 7 moreShow less3.1.33.1.43.1.53.1.63.1.73.1.83.1.9 |
3.1.13 |
org.springframework.boot:spring-boot-loader-classicMaven |
3.1.0 up to 3.1.13 | 3.1.13 |
org.springframework.boot:spring-boot-loaderMaven |
3.2.0 up to 3.2.9, plus listed versions 3.2.13.2.23.2.33.2.43.2.53.2.63.2.73.2.8 |
3.2.9 |
org.springframework.boot:spring-boot-loader-classicMaven |
3.2.0 up to 3.2.9, plus listed versions 3.2.13.2.23.2.33.2.43.2.53.2.63.2.73.2.8 |
3.2.9 |
org.springframework.boot:spring-boot-loaderMaven |
3.3.0 up to 3.3.3, plus listed versions 3.3.13.3.2 |
3.3.3 |
org.springframework.boot:spring-boot-loader-classicMaven |
3.3.0 up to 3.3.3, plus listed versions 3.3.13.3.2 |
3.3.3 |
org.springframework.boot:spring-boot-loaderRed Hat Lightwell:Maven |
before 2.7.18.rhlw-00004, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE |
2.7.18.rhlw-00004 |
io.root.org.springframework.boot:spring-boot-loaderRoot:Maven |
before 3.2.0-root.io.1 | 3.2.0-root.io.13.2.0-root.io.23.2.0-root.io.3 |
io.root.org.springframework.boot:spring-boot-loader-classicRoot:Maven |
before 3.2.0-root.io.1 | 3.2.0-root.io.13.2.0-root.io.23.2.0-root.io.3 |
org.springframework.boot:spring-boot-loaderRoot:Maven |
before 3.2.0-aikido.3 | 3.2.0-aikido.3 |
org.springframework.boot:spring-boot-loader-classicRoot:Maven |
before 3.2.0-aikido.3 | 3.2.0-aikido.3 |
libspring-javaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2 |
None known |
libspring-javaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.3.11-14.3.12-14.3.13-24.3.14-14.3.22-1~18.044.3.22-1~18.04.1~esm1 |
None known |
libspring-javaUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.3.22-44.3.22-4ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 4.3.30-14.3.30-1ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 4.3.30-24.3.30-2ubuntu0.24.04.1~esm1 |
None known |
libspring-javaUbuntu:25.10 |
All versions, plus listed versions 4.3.30-2ubuntu14.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.10 |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.04:LTS |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
spring.io/security/cve-2024-38807
security.netapp.com/advisory/ntap-20250117-0006
nvd.nist.gov/vuln/detail/CVE-2024-38807
github.com/advisories/GHSA-7cj3-x93g-gj76
security-tracker.debian.org/tracker/CVE-2024-38807
ubuntu.com/security/CVE-2024-38807
cve.org/CVERecord?id=CVE-2024-38807
Left out here: 136 versions. The JSON record has them.