CVE-2024-38828

CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter

5.3 MediumPublic exploitFix available

What does this mean?

: 5.3v3.1, from CVE List
: 0.72%54th percentile
Fixed in: 5.3.42org.springframework:spring-webmvc
Published: November 18, 2024
Modified: November 6, 2026
Weakness: CWE-400
Also known as: CLSA-2025-1743120048CLSA-2025-1751328209CLSA-2025-1756771563CLSA-2025-1760313981CLSA-2025-1760313986CLSA-2025-1761696401CLSA-2025-1762906011CLSA-2025-1765411678
Show 37 moreShow less
CLSA-2026-1777250292CLSA-2026-1777509589CLSA-2026-1782954026CLSA-2026-1786552823CLSA-2026-1786569587CLSA-2026-1786609560CLSA-2026-1788360559CLSA-2026-1789427454CLSA-2026-1790070464CLSA-2026-1790071189CLSA-2026-1790089638CLSA-2026-1790123797CLSA-2026-1790174512CLSA-2026-1790952166CLSA-2026-1792601588CLSA-2026-1793881017CLSA-2026-1793885497CLSA-2026-1793886526CLSA-2026-1793887544CLSA-2026-1793889159CLSA-2026-1793890045CLSA-2026-1793894396CLSA-2026-1793897475CLSA-2026-1793899775CLSA-2026-1793901153CLSA-2026-1793902842CLSA-2026-1793906268DEBIAN-CVE-2024-38828EUVD-2024-3320GHSA-7phw-cxx7-q9vqGHSA-cx7f-g6mp-7hqmGHSA-g5vr-rgqm-vf78GHSA-r936-gwx5-v52fGHSA-w3c8-7r8f-9jp8RHLW-2026-67afc831a93ff9ccROOT-APP-MAVEN-CVE-2024-38828UBUNTU-CVE-2024-38828

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.72%Up 0.7 points since Nov 18, 2024

What each source reports

CVE List Score used 5.3

CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Record: CVE-2024-38828
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2024-3320 5.3

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Record: EUVD-2024-3320
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w3c8-7r8f-9jp8 5.3

Spring MVC controller vulnerable to a DoS attack

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Record: GHSA-w3c8-7r8f-9jp8
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-400
Updated: 2026-11-02

NVD 5.3

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Record: CVE-2024-38828
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-400
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-38828 5.3

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Record: DEBIAN-CVE-2024-38828
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVGHSA-w3c8-7r8f-9jp8 5.3

Spring MVC controller vulnerable to a DoS attack

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Record: GHSA-w3c8-7r8f-9jp8
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-400
Updated: 2026-11-02

Show 39 moreShow less

OSVRHLW-2026-67afc831a93ff9cc 7.5

Lightwell Security Advisory: spring-webmvc 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-webmvc 5.3.18.rhlw-00010 with backported fixes for CVE-2023-20860, CVE-2024-38816, CVE-2024-38819, CVE-2024-38828, CVE-2025-41242, CVE-2026-22735, CVE-2026-22737, CVE-2026-22741, and CVE-2026-22745.

CVE-2023-20860: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

CVE-2024-38816: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Specifically, an application is vulnerable when both of the following are true:

the web application uses RouterFunctions to serve static resources
resource handling is explicitly configured with a FileSystemResource location

However, malicious requests are blocked and rejected when any of the following is true:

the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html is in use
the application runs on Tomcat or Jetty

CVE-2024-38819: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

CVE-2024-38828: Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

CVE-2025-41242: Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

the application is deployed as a WAR or with an embedded Servlet container
the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization
the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling

We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

This patched artifact is a drop-in replacement for org.springframework:spring-webmvc 5.3.18 from Maven Central.

Record: RHLW-2026-67afc831a93ff9cc
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-38828 5.3

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Record: UBUNTU-CVE-2024-38828
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVCLSA-2025-1743120048 No score

TuxCare security update for org.springframework:spring-webmvc (1 CVE)

TuxCare rebuilt org.springframework:spring-webmvc to address 1 CVE. Fixed in 5.3.39.tuxcare.4.

Record: CLSA-2025-1743120048
Updated: 2026-11-02

OSVCLSA-2025-1751328209 No score

TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 4 org.springframework packages to address 7 CVEs. Fixed in 5.3.27.tuxcare.1.

Record: CLSA-2025-1751328209
Updated: 2026-11-02

OSVCLSA-2025-1756771563 No score

TuxCare security update for org.springframework (16 CVEs)

TuxCare rebuilt 6 org.springframework packages to address 16 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.1.

Record: CLSA-2025-1756771563
Updated: 2026-11-02

OSVCLSA-2025-1760313981 No score

TuxCare security update for org.springframework (25 CVEs)

TuxCare rebuilt 6 org.springframework packages to address 25 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.1.

Record: CLSA-2025-1760313981
Updated: 2026-11-02

OSVCLSA-2025-1760313986 No score

TuxCare security update for org.springframework (29 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.

Record: CLSA-2025-1760313986
Updated: 2026-11-02

OSVCLSA-2025-1761696401 No score

TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 8 org.springframework packages to address 8 CVEs. Fixed in 5.3.31-tuxcare.1.

Record: CLSA-2025-1761696401
Updated: 2026-11-02

OSVCLSA-2025-1762906011 No score

TuxCare security update for org.springframework (12 CVEs)

TuxCare rebuilt 8 org.springframework packages to address 12 CVEs. Fixed in 5.3.30-tuxcare.1.

Record: CLSA-2025-1762906011
Updated: 2026-11-02

OSVCLSA-2025-1765411678 No score

TuxCare security update for org.springframework (5 CVEs)

TuxCare rebuilt 3 org.springframework packages to address 5 CVEs. Fixed in 5.3.29-tuxcare.2.

Record: CLSA-2025-1765411678
Updated: 2026-11-02

OSVCLSA-2026-1777250292 No score

TuxCare security update for org.springframework (5 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 5 CVEs. Fixed in 5.3.25-tuxcare.1.

Record: CLSA-2026-1777250292
Updated: 2026-11-02

OSVCLSA-2026-1777509589 No score

TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 3 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.2.

Record: CLSA-2026-1777509589
Updated: 2026-11-02

OSVCLSA-2026-1782954026 No score

TuxCare security update for org.springframework:spring-webmvc (1 CVE)

TuxCare rebuilt org.springframework:spring-webmvc to address 1 CVE. Fixed in 5.3.37-tuxcare.8.

Record: CLSA-2026-1782954026
Updated: 2026-11-02

OSVCLSA-2026-1786552823 No score

TuxCare security update for org.springframework (10 CVEs)

TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.3.7-tuxcare.5.

Record: CLSA-2026-1786552823
Updated: 2026-11-02

OSVCLSA-2026-1786569587 No score

TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.9.

Record: CLSA-2026-1786569587
Updated: 2026-11-02

OSVCLSA-2026-1786609560 No score

TuxCare security update for org.grails (18 CVEs)

TuxCare rebuilt 33 org.grails packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1.

Record: CLSA-2026-1786609560
Updated: 2026-11-02

OSVCLSA-2026-1788360559 No score

TuxCare security update for org.springframework (29 CVEs)

TuxCare rebuilt 10 org.springframework packages to address 29 CVEs. Fixed in 5.3.21-tuxcare.1.

Record: CLSA-2026-1788360559
Updated: 2026-11-02

OSVCLSA-2026-1789427454 No score

TuxCare security update for org.springframework (18 CVEs)

TuxCare rebuilt 9 org.springframework packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1.

Record: CLSA-2026-1789427454
Updated: 2026-11-02

OSVCLSA-2026-1790070464 No score

TuxCare security update for org.springframework (35 CVEs)

TuxCare rebuilt 11 org.springframework packages to address 35 CVEs. Fixed in 5.3.20-tuxcare.1.

Record: CLSA-2026-1790070464
Updated: 2026-11-02

OSVCLSA-2026-1790071189 No score

TuxCare security update for org.springframework (35 CVEs)

TuxCare rebuilt 10 org.springframework packages to address 35 CVEs. Fixed in 5.3.23-tuxcare.1.

Record: CLSA-2026-1790071189
Updated: 2026-11-02

OSVCLSA-2026-1790089638 No score

TuxCare security update for org.springframework (33 CVEs)

TuxCare rebuilt 11 org.springframework packages to address 33 CVEs. Fixed in 5.3.9-tuxcare.1.

Record: CLSA-2026-1790089638
Updated: 2026-11-02

OSVCLSA-2026-1790123797 No score

TuxCare security update for org.springframework (25 CVEs)

TuxCare rebuilt 8 org.springframework packages to address 25 CVEs. Fixed in 5.3.3-tuxcare.1.

Record: CLSA-2026-1790123797
Updated: 2026-11-02

OSVCLSA-2026-1790174512 No score

TuxCare security update for org.springframework (26 CVEs)

TuxCare rebuilt 9 org.springframework packages to address 26 CVEs. Fixed in 5.2.8.RELEASE-tuxcare.1.

Record: CLSA-2026-1790174512
Updated: 2026-11-02

OSVCLSA-2026-1790952166 No score

TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 4 org.springframework packages to address 6 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.5.

Record: CLSA-2026-1790952166
Updated: 2026-11-02

OSVCLSA-2026-1792601588 No score

TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 4.3.26.RELEASE-tuxcare.2.

Record: CLSA-2026-1792601588
Updated: 2026-11-02

OSVCLSA-2026-1793881017 No score

TuxCare security update for org.springframework (11 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 11 CVEs. Fixed in 5.3.19-tuxcare.4.

Record: CLSA-2026-1793881017
Updated: 2026-11-06

OSVCLSA-2026-1793885497 No score

TuxCare security update for org.springframework (13 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 13 CVEs. Fixed in 5.2.11.RELEASE-tuxcare.4.

Record: CLSA-2026-1793885497
Updated: 2026-11-06

OSVCLSA-2026-1793886526 No score

TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 5.3.18-tuxcare.4.

Record: CLSA-2026-1793886526
Updated: 2026-11-06

OSVCLSA-2026-1793887544 No score

TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 4 org.springframework packages to address 3 CVEs. Fixed in 5.2.10.RELEASE-tuxcare.4.

Record: CLSA-2026-1793887544
Updated: 2026-11-06

OSVCLSA-2026-1793889159 No score

TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 4 org.springframework packages to address 4 CVEs. Fixed in 5.2.17.RELEASE-tuxcare.4.

Record: CLSA-2026-1793889159
Updated: 2026-11-06

OSVCLSA-2026-1793890045 No score

TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 5 org.springframework packages to address 4 CVEs. Fixed in 5.2.7.RELEASE-tuxcare.4.

Record: CLSA-2026-1793890045
Updated: 2026-11-06

OSVCLSA-2026-1793894396 No score

TuxCare security update for org.springframework:spring-webmvc (1 CVE)

TuxCare rebuilt org.springframework:spring-webmvc to address 1 CVE. Fixed in 5.2.0.RELEASE-tuxcare.9.

Record: CLSA-2026-1793894396
Updated: 2026-11-06

OSVCLSA-2026-1793897475 No score

TuxCare security update for org.springframework (12 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 12 CVEs. Fixed in 5.0.19.RELEASE-tuxcare.4.

Record: CLSA-2026-1793897475
Updated: 2026-11-06

OSVCLSA-2026-1793899775 No score

TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 3 org.springframework packages to address 4 CVEs. Fixed in 5.2.25.RELEASE-tuxcare.5.

Record: CLSA-2026-1793899775
Updated: 2026-11-06

OSVCLSA-2026-1793901153 No score

TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 4.3.25.RELEASE-tuxcare.7.

Record: CLSA-2026-1793901153
Updated: 2026-11-06

OSVCLSA-2026-1793902842 No score

TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.8.

Record: CLSA-2026-1793902842
Updated: 2026-11-06

OSVCLSA-2026-1793906268 No score

TuxCare security update for org.springframework:spring-webmvc (1 CVE)

TuxCare rebuilt org.springframework:spring-webmvc to address 1 CVE. Fixed in 4.3.21.RELEASE-tuxcare.4.

Record: CLSA-2026-1793906268
Updated: 2026-11-06

OSV No score

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

Record: CVE-2024-38828
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2024-38828 No score

CVE-2024-38828 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38828 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2024-38828
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework:spring-webmvc` Maven	5.3.0 up to 5.3.42	5.3.42
`org.springframework:spring-webmvc` TuxCare:Maven	5.3.39 up to 5.3.39.tuxcare.4, plus listed versions 5.3.39.tuxcare.15.3.39.tuxcare.3	5.3.39.tuxcare.4
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 7 CVEs	5.3.27 up to 5.3.27.tuxcare.1	5.3.27.tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 7 CVEs	5.3.27 up to 5.3.27.tuxcare.1	5.3.27.tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 7 CVEs	5.3.27 up to 5.3.27.tuxcare.1	5.3.27.tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 7 CVEs	5.3.27 up to 5.3.27.tuxcare.1	5.3.27.tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 16 CVEs	4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1	4.3.30.RELEASE-tuxcare.1
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 16 CVEs	4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1	4.3.30.RELEASE-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 16 CVEs	4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1	4.3.30.RELEASE-tuxcare.1
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 16 CVEs	4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1	4.3.30.RELEASE-tuxcare.1

Show 190 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 16 CVEs	4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1	4.3.30.RELEASE-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 16 CVEs	4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1	4.3.30.RELEASE-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 25 CVEs	4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1	4.0.0.RELEASE-tuxcare.1
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 25 CVEs	4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1	4.0.0.RELEASE-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 25 CVEs	4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1	4.0.0.RELEASE-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 25 CVEs	4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1	4.0.0.RELEASE-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 25 CVEs	4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1	4.0.0.RELEASE-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 25 CVEs	4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1	4.0.0.RELEASE-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 29 CVEs	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 29 CVEs	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 29 CVEs	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 29 CVEs	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-oxm` TuxCare:Maven From an advisory covering 29 CVEs	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 29 CVEs	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 29 CVEs	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 8 CVEs	5.3.31 up to 5.3.31-tuxcare.1, plus listed versions 5.3.31.tuxcare	5.3.31-tuxcare.1
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 8 CVEs	5.3.31 up to 5.3.31-tuxcare.1, plus listed versions 5.3.31.tuxcare	5.3.31-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 8 CVEs	5.3.31 up to 5.3.31-tuxcare.1, plus listed versions 5.3.31.tuxcare	5.3.31-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 8 CVEs	5.3.31 up to 5.3.31-tuxcare.1, plus listed versions 5.3.31.tuxcare	5.3.31-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 8 CVEs	5.3.31 up to 5.3.31-tuxcare.1, plus listed versions 5.3.31.tuxcare	5.3.31-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 8 CVEs	5.3.31 up to 5.3.31-tuxcare.1, plus listed versions 5.3.31.tuxcare	5.3.31-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 8 CVEs	5.3.31 up to 5.3.31-tuxcare.1, plus listed versions 5.3.31.tuxcare	5.3.31-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 8 CVEs	5.3.31 up to 5.3.31-tuxcare.1, plus listed versions 5.3.31.tuxcare	5.3.31-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 12 CVEs	5.3.30 up to 5.3.30-tuxcare.1	5.3.30-tuxcare.1
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 12 CVEs	5.3.30 up to 5.3.30-tuxcare.1	5.3.30-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 12 CVEs	5.3.30 up to 5.3.30-tuxcare.1	5.3.30-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 12 CVEs	5.3.30 up to 5.3.30-tuxcare.1	5.3.30-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 12 CVEs	5.3.30 up to 5.3.30-tuxcare.1	5.3.30-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 12 CVEs	5.3.30 up to 5.3.30-tuxcare.1	5.3.30-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 12 CVEs	5.3.30 up to 5.3.30-tuxcare.1	5.3.30-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 12 CVEs	5.3.30 up to 5.3.30-tuxcare.1	5.3.30-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 5 CVEs	5.3.29 up to 5.3.29-tuxcare.2, plus listed versions 5.3.29-tuxcare.1	5.3.29-tuxcare.2
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 5 CVEs	5.3.29 up to 5.3.29-tuxcare.2, plus listed versions 5.3.29-tuxcare.1	5.3.29-tuxcare.2
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 5 CVEs	5.3.29 up to 5.3.29-tuxcare.2, plus listed versions 5.3.29-tuxcare.1	5.3.29-tuxcare.2
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 5 CVEs	5.3.25 up to 5.3.25-tuxcare.1	5.3.25-tuxcare.1
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 5 CVEs	5.3.25 up to 5.3.25-tuxcare.1	5.3.25-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 5 CVEs	5.3.25 up to 5.3.25-tuxcare.1	5.3.25-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 5 CVEs	5.3.25 up to 5.3.25-tuxcare.1	5.3.25-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 5 CVEs	5.3.25 up to 5.3.25-tuxcare.1	5.3.25-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 5 CVEs	5.3.25 up to 5.3.25-tuxcare.1	5.3.25-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 5 CVEs	5.3.25 up to 5.3.25-tuxcare.1	5.3.25-tuxcare.1
`org.springframework:spring` TuxCare:Maven From an advisory covering 4 CVEs	5.3.24 up to 5.3.24-tuxcare.2, plus listed versions 5.3.24-tuxcare.1	5.3.24-tuxcare.2
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 4 CVEs	5.3.24 up to 5.3.24-tuxcare.2, plus listed versions 5.3.24-tuxcare.1	5.3.24-tuxcare.2
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 4 CVEs	5.3.24 up to 5.3.24-tuxcare.2, plus listed versions 5.3.24-tuxcare.1	5.3.24-tuxcare.2
`org.springframework:spring-webmvc` TuxCare:Maven	5.3.37 up to 5.3.37-tuxcare.8, plus listed versions 5.3.37-tuxcare.15.3.37-tuxcare.25.3.37-tuxcare.35.3.37-tuxcare.45.3.37-tuxcare.55.3.37-tuxcare.65.3.37-tuxcare.7	5.3.37-tuxcare.8
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 2 CVEs	5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.9, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.65.2.13.RELEASE-tuxcare.75.2.13.RELEASE-tuxcare.8	5.2.13.RELEASE-tuxcare.9
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 2 CVEs	5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.9, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.65.2.13.RELEASE-tuxcare.75.2.13.RELEASE-tuxcare.8	5.2.13.RELEASE-tuxcare.9
`org.springframework:spring` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 29 CVEs	5.3.21 up to 5.3.21-tuxcare.1	5.3.21-tuxcare.1
`org.springframework:spring` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-context-support` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-context-support` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 35 CVEs	5.3.20 up to 5.3.20-tuxcare.1	5.3.20-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring-context-support` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 35 CVEs	5.3.23 up to 5.3.23-tuxcare.1	5.3.23-tuxcare.1
`org.springframework:spring` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-context-support` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 33 CVEs	5.3.9 up to 5.3.9-tuxcare.1	5.3.9-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 25 CVEs	5.3.3 up to 5.3.3-tuxcare.1	5.3.3-tuxcare.1
`org.springframework:spring-context-support` TuxCare:Maven From an advisory covering 25 CVEs	5.3.3 up to 5.3.3-tuxcare.1	5.3.3-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 25 CVEs	5.3.3 up to 5.3.3-tuxcare.1	5.3.3-tuxcare.1
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 25 CVEs	5.3.3 up to 5.3.3-tuxcare.1	5.3.3-tuxcare.1
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 25 CVEs	5.3.3 up to 5.3.3-tuxcare.1	5.3.3-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 25 CVEs	5.3.3 up to 5.3.3-tuxcare.1	5.3.3-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 25 CVEs	5.3.3 up to 5.3.3-tuxcare.1	5.3.3-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 25 CVEs	5.3.3 up to 5.3.3-tuxcare.1	5.3.3-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 26 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.1	5.2.8.RELEASE-tuxcare.1
`org.springframework:spring-context-support` TuxCare:Maven From an advisory covering 26 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.1	5.2.8.RELEASE-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 26 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.1	5.2.8.RELEASE-tuxcare.1
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 26 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.1	5.2.8.RELEASE-tuxcare.1
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 26 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.1	5.2.8.RELEASE-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 26 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.1	5.2.8.RELEASE-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 26 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.1	5.2.8.RELEASE-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 26 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.1	5.2.8.RELEASE-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 26 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.1	5.2.8.RELEASE-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 6 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.5, plus listed versions 5.1.5.RELEASE-tuxcare.15.1.5.RELEASE-tuxcare.25.1.5.RELEASE-tuxcare.35.1.5.RELEASE-tuxcare.4	5.1.5.RELEASE-tuxcare.5
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 6 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.5, plus listed versions 5.1.5.RELEASE-tuxcare.15.1.5.RELEASE-tuxcare.25.1.5.RELEASE-tuxcare.35.1.5.RELEASE-tuxcare.4	5.1.5.RELEASE-tuxcare.5
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 6 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.5, plus listed versions 5.1.5.RELEASE-tuxcare.15.1.5.RELEASE-tuxcare.25.1.5.RELEASE-tuxcare.35.1.5.RELEASE-tuxcare.4	5.1.5.RELEASE-tuxcare.5
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 6 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.5, plus listed versions 5.1.5.RELEASE-tuxcare.15.1.5.RELEASE-tuxcare.25.1.5.RELEASE-tuxcare.35.1.5.RELEASE-tuxcare.4	5.1.5.RELEASE-tuxcare.5
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 3 CVEs	4.3.26.RELEASE up to 4.3.26.RELEASE-tuxcare.2, plus listed versions 4.3.26.RELEASE-tuxcare.1	4.3.26.RELEASE-tuxcare.2
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 3 CVEs	4.3.26.RELEASE up to 4.3.26.RELEASE-tuxcare.2, plus listed versions 4.3.26.RELEASE-tuxcare.1	4.3.26.RELEASE-tuxcare.2
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 3 CVEs	4.3.26.RELEASE up to 4.3.26.RELEASE-tuxcare.2, plus listed versions 4.3.26.RELEASE-tuxcare.1	4.3.26.RELEASE-tuxcare.2
`org.springframework:spring` TuxCare:Maven From an advisory covering 11 CVEs	5.3.19 up to 5.3.19-tuxcare.4, plus listed versions 5.3.19-tuxcare.15.3.19-tuxcare.25.3.19-tuxcare.3	5.3.19-tuxcare.4
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 11 CVEs	5.3.19 up to 5.3.19-tuxcare.4, plus listed versions 5.3.19-tuxcare.15.3.19-tuxcare.25.3.19-tuxcare.3	5.3.19-tuxcare.4
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 11 CVEs	5.3.19 up to 5.3.19-tuxcare.4, plus listed versions 5.3.19-tuxcare.15.3.19-tuxcare.25.3.19-tuxcare.3	5.3.19-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 11 CVEs	5.3.19 up to 5.3.19-tuxcare.4, plus listed versions 5.3.19-tuxcare.15.3.19-tuxcare.25.3.19-tuxcare.3	5.3.19-tuxcare.4
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 11 CVEs	5.3.19 up to 5.3.19-tuxcare.4, plus listed versions 5.3.19-tuxcare.15.3.19-tuxcare.25.3.19-tuxcare.3	5.3.19-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 11 CVEs	5.3.19 up to 5.3.19-tuxcare.4, plus listed versions 5.3.19-tuxcare.15.3.19-tuxcare.25.3.19-tuxcare.3	5.3.19-tuxcare.4
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 11 CVEs	5.3.19 up to 5.3.19-tuxcare.4, plus listed versions 5.3.19-tuxcare.15.3.19-tuxcare.25.3.19-tuxcare.3	5.3.19-tuxcare.4
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-framework-bom` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 3 CVEs	5.3.18 up to 5.3.18-tuxcare.4, plus listed versions 5.3.18-tuxcare.15.3.18-tuxcare.25.3.18-tuxcare.3	5.3.18-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 3 CVEs	5.3.18 up to 5.3.18-tuxcare.4, plus listed versions 5.3.18-tuxcare.15.3.18-tuxcare.25.3.18-tuxcare.3	5.3.18-tuxcare.4
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 3 CVEs	5.3.18 up to 5.3.18-tuxcare.4, plus listed versions 5.3.18-tuxcare.15.3.18-tuxcare.25.3.18-tuxcare.3	5.3.18-tuxcare.4
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 3 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.4, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.25.2.10.RELEASE-tuxcare.3	5.2.10.RELEASE-tuxcare.4
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 3 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.4, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.25.2.10.RELEASE-tuxcare.3	5.2.10.RELEASE-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 3 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.4, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.25.2.10.RELEASE-tuxcare.3	5.2.10.RELEASE-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 3 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.4, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.25.2.10.RELEASE-tuxcare.3	5.2.10.RELEASE-tuxcare.4
`org.springframework:spring` TuxCare:Maven From an advisory covering 4 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.4, plus listed versions 5.2.17.RELEASE-tuxcare.15.2.17.RELEASE-tuxcare.25.2.17.RELEASE-tuxcare.3	5.2.17.RELEASE-tuxcare.4
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 4 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.4, plus listed versions 5.2.17.RELEASE-tuxcare.15.2.17.RELEASE-tuxcare.25.2.17.RELEASE-tuxcare.3	5.2.17.RELEASE-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 4 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.4, plus listed versions 5.2.17.RELEASE-tuxcare.15.2.17.RELEASE-tuxcare.25.2.17.RELEASE-tuxcare.3	5.2.17.RELEASE-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 4 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.4, plus listed versions 5.2.17.RELEASE-tuxcare.15.2.17.RELEASE-tuxcare.25.2.17.RELEASE-tuxcare.3	5.2.17.RELEASE-tuxcare.4
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 4 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.4, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.25.2.7.RELEASE-tuxcare.3	5.2.7.RELEASE-tuxcare.4
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 4 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.4, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.25.2.7.RELEASE-tuxcare.3	5.2.7.RELEASE-tuxcare.4
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 4 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.4, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.25.2.7.RELEASE-tuxcare.3	5.2.7.RELEASE-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 4 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.4, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.25.2.7.RELEASE-tuxcare.3	5.2.7.RELEASE-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 4 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.4, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.25.2.7.RELEASE-tuxcare.3	5.2.7.RELEASE-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven	5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.9, plus listed versions 5.2.0.RELEASE-tuxcare.15.2.0.RELEASE-tuxcare.25.2.0.RELEASE-tuxcare.35.2.0.RELEASE-tuxcare.45.2.0.RELEASE-tuxcare.55.2.0.RELEASE-tuxcare.65.2.0.RELEASE-tuxcare.75.2.0.RELEASE-tuxcare.8	5.2.0.RELEASE-tuxcare.9
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 12 CVEs	5.0.19.RELEASE up to 5.0.19.RELEASE-tuxcare.4, plus listed versions 5.0.19.RELEASE-tuxcare.15.0.19.RELEASE-tuxcare.25.0.19.RELEASE-tuxcare.3	5.0.19.RELEASE-tuxcare.4
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 12 CVEs	5.0.19.RELEASE up to 5.0.19.RELEASE-tuxcare.4, plus listed versions 5.0.19.RELEASE-tuxcare.15.0.19.RELEASE-tuxcare.25.0.19.RELEASE-tuxcare.3	5.0.19.RELEASE-tuxcare.4
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 12 CVEs	5.0.19.RELEASE up to 5.0.19.RELEASE-tuxcare.4, plus listed versions 5.0.19.RELEASE-tuxcare.15.0.19.RELEASE-tuxcare.25.0.19.RELEASE-tuxcare.3	5.0.19.RELEASE-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 12 CVEs	5.0.19.RELEASE up to 5.0.19.RELEASE-tuxcare.4, plus listed versions 5.0.19.RELEASE-tuxcare.15.0.19.RELEASE-tuxcare.25.0.19.RELEASE-tuxcare.3	5.0.19.RELEASE-tuxcare.4
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 12 CVEs	5.0.19.RELEASE up to 5.0.19.RELEASE-tuxcare.4, plus listed versions 5.0.19.RELEASE-tuxcare.15.0.19.RELEASE-tuxcare.25.0.19.RELEASE-tuxcare.3	5.0.19.RELEASE-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 12 CVEs	5.0.19.RELEASE up to 5.0.19.RELEASE-tuxcare.4, plus listed versions 5.0.19.RELEASE-tuxcare.15.0.19.RELEASE-tuxcare.25.0.19.RELEASE-tuxcare.3	5.0.19.RELEASE-tuxcare.4
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 12 CVEs	5.0.19.RELEASE up to 5.0.19.RELEASE-tuxcare.4, plus listed versions 5.0.19.RELEASE-tuxcare.15.0.19.RELEASE-tuxcare.25.0.19.RELEASE-tuxcare.3	5.0.19.RELEASE-tuxcare.4
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 4 CVEs	5.2.25.RELEASE up to 5.2.25.RELEASE-tuxcare.5, plus listed versions 5.2.25.RELEASE-tuxcare.15.2.25.RELEASE-tuxcare.25.2.25.RELEASE-tuxcare.35.2.25.RELEASE-tuxcare.4	5.2.25.RELEASE-tuxcare.5
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 4 CVEs	5.2.25.RELEASE up to 5.2.25.RELEASE-tuxcare.5, plus listed versions 5.2.25.RELEASE-tuxcare.15.2.25.RELEASE-tuxcare.25.2.25.RELEASE-tuxcare.35.2.25.RELEASE-tuxcare.4	5.2.25.RELEASE-tuxcare.5
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 4 CVEs	5.2.25.RELEASE up to 5.2.25.RELEASE-tuxcare.5, plus listed versions 5.2.25.RELEASE-tuxcare.15.2.25.RELEASE-tuxcare.25.2.25.RELEASE-tuxcare.35.2.25.RELEASE-tuxcare.4	5.2.25.RELEASE-tuxcare.5
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 2 CVEs	4.3.25.RELEASE up to 4.3.25.RELEASE-tuxcare.7, plus listed versions 4.3.25.RELEASE-tuxcare.14.3.25.RELEASE-tuxcare.24.3.25.RELEASE-tuxcare.34.3.25.RELEASE-tuxcare.44.3.25.RELEASE-tuxcare.54.3.25.RELEASE-tuxcare.6	4.3.25.RELEASE-tuxcare.7
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 2 CVEs	4.3.25.RELEASE up to 4.3.25.RELEASE-tuxcare.7, plus listed versions 4.3.25.RELEASE-tuxcare.14.3.25.RELEASE-tuxcare.24.3.25.RELEASE-tuxcare.34.3.25.RELEASE-tuxcare.44.3.25.RELEASE-tuxcare.54.3.25.RELEASE-tuxcare.6	4.3.25.RELEASE-tuxcare.7
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 3 CVEs	5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.8, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.35.1.20.RELEASE-tuxcare.45.1.20.RELEASE-tuxcare.55.1.20.RELEASE-tuxcare.65.1.20.RELEASE-tuxcare.7	5.1.20.RELEASE-tuxcare.8
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 3 CVEs	5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.8, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.35.1.20.RELEASE-tuxcare.45.1.20.RELEASE-tuxcare.55.1.20.RELEASE-tuxcare.65.1.20.RELEASE-tuxcare.7	5.1.20.RELEASE-tuxcare.8
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 3 CVEs	5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.8, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.35.1.20.RELEASE-tuxcare.45.1.20.RELEASE-tuxcare.55.1.20.RELEASE-tuxcare.65.1.20.RELEASE-tuxcare.7	5.1.20.RELEASE-tuxcare.8
`org.springframework:spring-webmvc` TuxCare:Maven	4.3.21.RELEASE up to 4.3.21.RELEASE-tuxcare.4, plus listed versions 4.3.21.RELEASE-tuxcare.14.3.21.RELEASE-tuxcare.24.3.21.RELEASE-tuxcare.3	4.3.21.RELEASE-tuxcare.4
`libspring-java` Debian:12	All versions, plus listed versions 4.3.30-24.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1	None known
`libspring-java` Debian:13	All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1	None known
`libspring-java` Debian:14	All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1	None known
`org.springframework:spring-webmvc` Maven	5.3.0 up to 5.3.42, plus listed versions 5.3.15.3.105.3.115.3.125.3.13 Show 34 moreShow less 5.3.145.3.155.3.165.3.175.3.185.3.195.3.25.3.205.3.215.3.225.3.235.3.245.3.255.3.265.3.275.3.285.3.295.3.35.3.305.3.315.3.325.3.335.3.345.3.355.3.365.3.375.3.385.3.395.3.45.3.55.3.65.3.75.3.85.3.9	5.3.42
`org.springframework:spring-webmvc` Red Hat Lightwell:Maven From an advisory covering 9 CVEs	before 5.3.18.rhlw-00010, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less 1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE	5.3.18.rhlw-00010
`org.springframework:spring-webmvc` Root:Maven	before 5.3.20-aikido.3	5.3.20-aikido.35.3.20-aikido.45.3.23-aikido.45.3.23-aikido.55.3.20-aikido.55.3.23-aikido.65.3.20-aikido.65.3.20-aikido.75.3.20-aikido.8
`io.root.org.springframework:spring-webmvc` Root:Maven	before 5.3.20-root.io.3	5.3.20-root.io.35.3.20-root.io.45.3.23-root.io.45.3.23-root.io.55.3.20-root.io.55.3.23-root.io.65.3.20-root.io.65.3.20-root.io.75.3.20-root.io.8
`libspring-java` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less 3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2	None known
`libspring-java` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1	None known
`libspring-java` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 4.3.11-14.3.12-14.3.13-24.3.14-14.3.22-1~18.044.3.22-1~18.04.1~esm1	None known
`libspring-java` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 4.3.22-44.3.22-4ubuntu0.1~esm1	None known
`libspring-java` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 4.3.30-14.3.30-1ubuntu0.1~esm1	None known
`libspring-java` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 4.3.30-24.3.30-2ubuntu0.24.04.1~esm1	None known
`libspring-java` Ubuntu:25.10	All versions, plus listed versions 4.3.30-2ubuntu14.3.30-3ubuntu1	None known
`libspring-java` Ubuntu:26.10	All versions, plus listed versions 4.3.30-3ubuntu1	None known
`libspring-java` Ubuntu:26.04:LTS	All versions, plus listed versions 4.3.30-3ubuntu1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	First-Roman/sprig-mvc-demo-patch	2025-04-14
PoC in GitHub	topilov/axiom-jdk-test-task	2025-04-21
PoC in GitHub	funcid/CVE-2024-38828	2025-04-22

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, aliases
Nov 6, 2026	affected, aliases	OSV
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38828 is a medium vulnerability (CVSS 5.3) in Spring, published November 18, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in org.springframework:spring-webmvc 5.3.42.

References

Show 19 moreShow less

This page doesn't list everything

Left out here: 179 versions. The JSON record has them.