CVE-2024-38821

Authorization Bypass of Static Resources in WebFlux Applications

9.1 CriticalPublic exploitFix available

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.74%Up 1.7 points since Oct 29, 2024

What each source reports

CVE List Score used 9.1

Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: CVE-2024-38821
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-770
Updated: 2026-11-02

EUVDEUVD-2024-3011 9.1

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: EUVD-2024-3011
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c4q5-6c82-3qpw 9.3

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: GHSA-c4q5-6c82-3qpw
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-285, CWE-770
Updated: 2026-11-02

NVD 9.1

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: CVE-2024-38821
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-770
Updated: 2026-11-02

OSVGHSA-c4q5-6c82-3qpw 9.3

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

It must be a WebFlux application
It must be using Spring's static resources support
It must have a non-permitAll authorization rule applied to the static resources support

Record: GHSA-c4q5-6c82-3qpw
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-285, CWE-770
Updated: 2026-11-02

OSVRHLW-2026-eeb3d4215beae0d6 9.1

Lightwell Security Advisory: spring-security-web 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-web 5.7.11.rhlw-00006 with backported fixes for CVE-2024-38821 and CVE-2026-22732.

CVE-2026-22732: Under Some Conditions Spring Security HTTP Headers Are not Written

This patched artifact is a drop-in replacement for org.springframework.security:spring-security-web 5.7.11 from Maven Central.

Record: RHLW-2026-eeb3d4215beae0d6
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Show 16 moreShow less

OSVROOT-APP-MAVEN-CVE-2024-38821 9.1

CVE-2024-38821 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2024-38821 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2024-38821
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVCLSA-2026-1768349319 No score

TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 6.1.6-tuxcare.1.

Record: CLSA-2026-1768349319
Updated: 2026-11-02

OSVCLSA-2026-1774398070 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.12-tuxcare.1.

Record: CLSA-2026-1774398070
Updated: 2026-11-02

OSVCLSA-2026-1774570928 No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.7.11-tuxcare.1.

Record: CLSA-2026-1774570928
Updated: 2026-11-02

OSVCLSA-2026-1775435426 No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 6 CVEs. Fixed in 6.2.2-tuxcare.1.

Record: CLSA-2026-1775435426
Updated: 2026-11-02

OSVCLSA-2026-1776126833 No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.6.10-tuxcare.1.

Record: CLSA-2026-1776126833
Updated: 2026-11-02

OSVCLSA-2026-1785814692 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.0.8-tuxcare.1.

Record: CLSA-2026-1785814692
Updated: 2026-11-02

OSVCLSA-2026-1789676383 No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 8 CVEs. Fixed in 5.8.14-tuxcare.1.

Record: CLSA-2026-1789676383
Updated: 2026-11-02

OSVCLSA-2026-1791380003 No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.

Record: CLSA-2026-1791380003
Updated: 2026-11-02

OSVCLSA-2026-1791391633 No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.

Record: CLSA-2026-1791391633
Updated: 2026-11-02

OSVCLSA-2026-1791392813 No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.9-tuxcare.1.

Record: CLSA-2026-1791392813
Updated: 2026-11-02

OSVCLSA-2026-1792079446 No score

TuxCare security update for org.springframework.security (15 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.

Record: CLSA-2026-1792079446
Updated: 2026-11-02

OSVCLSA-2026-1792089227 No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.

Record: CLSA-2026-1792089227
Updated: 2026-11-02

OSVCLSA-2026-1792102802 No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.

Record: CLSA-2026-1792102802
Updated: 2026-11-02

OSVCLSA-2026-1792502421 No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 5.1.4.RELEASE-tuxcare.1.

Record: CLSA-2026-1792502421
Updated: 2026-11-02

OSVCLSA-2026-1792503291 No score

TuxCare security update for org.springframework.security (9 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.

Record: CLSA-2026-1792503291
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-web` Maven	5.8.0 up to 5.8.15	5.8.15
`org.springframework.security:spring-security-web` Maven	6.2.0 up to 6.2.7	6.2.7
`org.springframework.security:spring-security-web` Maven	6.0.0 up to 6.0.13	6.0.13
`org.springframework.security:spring-security-web` Maven	6.1.0 up to 6.1.11	6.1.11
`org.springframework.security:spring-security-web` Maven	6.3.0 up to 6.3.4	6.3.4
`org.springframework.security:spring-security-web` Maven	5.0.0 up to 5.7.13	5.7.13
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 4 CVEs	6.1.6 up to 6.1.6-tuxcare.1	6.1.6-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 4 CVEs	6.1.6 up to 6.1.6-tuxcare.1	6.1.6-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	5.7.12 up to 5.7.12-tuxcare.1	5.7.12-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 3 CVEs	5.7.12 up to 5.7.12-tuxcare.1	5.7.12-tuxcare.1

Show 59 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	6.0.8 up to 6.0.8-tuxcare.1	6.0.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	6.0.8 up to 6.0.8-tuxcare.1	6.0.8-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 3 CVEs	6.0.8 up to 6.0.8-tuxcare.1	6.0.8-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	5.8.14 up to 5.8.14-tuxcare.1	5.8.14-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` Maven	5.0.0 up to 5.7.13, plus listed versions 5.0.0.RELEASE5.0.1.RELEASE5.0.10.RELEASE5.0.11.RELEASE5.0.12.RELEASE Show 45 moreShow less 5.0.13.RELEASE5.0.14.RELEASE5.0.15.RELEASE5.0.16.RELEASE5.0.17.RELEASE5.0.18.RELEASE5.0.19.RELEASE5.0.2.RELEASE5.0.3.RELEASE5.0.4.RELEASE5.0.5.RELEASE5.0.6.RELEASE5.0.7.RELEASE5.0.8.RELEASE5.0.9.RELEASE5.1.0.RELEASE5.1.1.RELEASE5.1.10.RELEASE5.1.11.RELEASE5.1.12.RELEASE5.1.13.RELEASE5.1.2.RELEASE5.1.3.RELEASE5.1.4.RELEASE5.1.5.RELEASE5.1.6.RELEASE5.1.7.RELEASE5.1.8.RELEASE5.1.9.RELEASE5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE5.2.13.RELEASE5.2.14.RELEASE5.2.15.RELEASE5.2.2.RELEASE5.2.3.RELEASE5.2.4.RELEASE5.2.5.RELEASE5.2.6.RELEASE5.2.7.RELEASE5.2.8.RELEASE5.2.9.RELEASE	5.7.13
`org.springframework.security:spring-security-web` Maven	5.8.0 up to 5.8.15, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 9 moreShow less 5.8.145.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9	5.8.15
`org.springframework.security:spring-security-web` Maven	6.2.0 up to 6.2.7, plus listed versions 6.2.16.2.26.2.36.2.46.2.56.2.6	6.2.7
`org.springframework.security:spring-security-web` Maven	6.0.0 up to 6.0.13, plus listed versions 6.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.8	6.0.13
`org.springframework.security:spring-security-web` Maven	6.1.0 up to 6.1.11, plus listed versions 6.1.16.1.26.1.36.1.46.1.5 Show 4 moreShow less 6.1.66.1.76.1.86.1.9	6.1.11
`org.springframework.security:spring-security-web` Maven	6.3.0 up to 6.3.4, plus listed versions 6.3.16.3.26.3.3	6.3.4
`org.springframework.security:spring-security-web` Red Hat Lightwell:Maven From an advisory covering 2 CVEs	before 5.7.11.rhlw-00006, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 45 moreShow less 3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE	5.7.11.rhlw-00006
`org.springframework.security:spring-security-web` Root:Maven	before 6.1.3-aikido.5	6.1.3-aikido.56.2.0-aikido.26.3.3-aikido.26.2.0-aikido.36.2.0-aikido.46.1.3-aikido.66.1.3-aikido.76.2.0-aikido.55.2.2.RELEASE-aikido.15.2.2.RELEASE-aikido.2
`io.root.org.springframework.security:spring-security-web` Root:Maven	before 6.1.3-root.io.1	6.1.3-root.io.16.1.3-root.io.46.2.0-root.io.16.3.3-root.io.16.1.3-root.io.56.2.0-root.io.26.3.3-root.io.26.2.0-root.io.36.2.0-root.io.46.1.3-root.io.66.1.3-root.io.76.2.0-root.io.55.2.2.RELEASE-root.io.15.2.2.RELEASE-root.io.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	mouadk/cve-2024-38821	2024-10-30
PoC in GitHub	masa42/CVE-2024-38821-POC	2025-01-18

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	aliases, products, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38821 is a critical vulnerability (CVSS 9.1) in Spring, published October 28, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in org.springframework.security:spring-security-web 5.8.15.

References

Show 6 moreShow less

This page doesn't list everything

Left out here: 181 versions. The JSON record has them.