CVE-2018-1257
Denial of Service in org.springframework:spring-core
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- Record
CVE-2018-1257- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- Record
CVE-2018-1257- Updated
- 2026-11-02
EUVDEUVD-2018-0682 No score
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- Record
EUVD-2018-0682- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rcpf-vj53-7h2m
Denial of Service in org.springframework:spring-core
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- Record
GHSA-rcpf-vj53-7h2m- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- Record
CVE-2018-1257- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1257
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- Record
DEBIAN-CVE-2018-1257- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-rcpf-vj53-7h2m
Denial of Service in org.springframework:spring-core
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- Record
GHSA-rcpf-vj53-7h2m- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1257
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- Record
UBUNTU-CVE-2018-1257- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1779324479 No score
TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.2.
- Record
CLSA-2026-1779324479- Updated
- 2026-11-02
OSVCLSA-2026-1784769548 No score
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 3 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1784769548- Updated
- 2026-11-02
OSVCLSA-2026-1785380498 No score
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 6 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785380498- Updated
- 2026-11-02
OSVCLSA-2026-1789416166 No score
TuxCare security update for org.springframework (12 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 12 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.5.
- Record
CLSA-2026-1789416166- Updated
- 2026-11-02
OSVCLSA-2026-1791107509 No score
TuxCare security update for org.springframework (35 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 35 CVEs. Fixed in 5.0.0.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791107509- Updated
- 2026-11-02
OSVCLSA-2026-1791289094 No score
TuxCare security update for org.springframework (31 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 31 CVEs. Fixed in 4.3.16.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791289094- Updated
- 2026-11-02
OSVCLSA-2026-1791463819 No score
TuxCare security update for org.springframework (35 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 35 CVEs. Fixed in 4.3.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791463819- Updated
- 2026-11-02
Affected products
- pivotal spring framework
- vmware spring framework
- oracle agile product lifecycle management
- oracle application testing suite
- oracle big data discovery
- oracle communications converged application server
- oracle communications diameter signaling router
- oracle communications performance intelligence center
- oracle communications services gatekeeper
- oracle communications unified inventory management
- oracle endeca information discovery integrator
- oracle enterprise manager base platform
Show 19 moreShow less
- oracle enterprise manager for mysql database
- oracle enterprise manager ops center
- oracle flexcube private banking
- oracle goldengate for big data
- oracle health sciences information manager
- oracle healthcare master person index
- oracle hospitality guest access
- oracle insurance calculation engine
- oracle insurance rules palette
- oracle primavera gateway
- oracle retail customer insights
- oracle retail open commerce platform
- oracle retail order broker
- oracle retail predictive application server
- oracle service architecture leveraging tuxedo
- oracle tape library acsls
- oracle utilities network management system
- oracle weblogic server
- redhat openshift
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreMaven |
5.0.0 up to 5.0.6 | 5.0.6 |
org.springframework:spring-coreMaven |
before 4.3.17 | 4.3.17 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.2, plus listed versions 4.2.9.RELEASE-tuxcare.1 |
4.2.9.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.2, plus listed versions 4.2.9.RELEASE-tuxcare.1 |
4.2.9.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.1 | 5.0.5.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 3 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.1 | 5.0.5.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
Show 44 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 12 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.5, plus listed versions 4.3.4.RELEASE-tuxcare.14.3.4.RELEASE-tuxcare.24.3.4.RELEASE-tuxcare.34.3.4.RELEASE-tuxcare.4 |
4.3.4.RELEASE-tuxcare.5 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 12 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.5, plus listed versions 4.3.4.RELEASE-tuxcare.14.3.4.RELEASE-tuxcare.24.3.4.RELEASE-tuxcare.34.3.4.RELEASE-tuxcare.4 |
4.3.4.RELEASE-tuxcare.5 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 12 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.5, plus listed versions 4.3.4.RELEASE-tuxcare.14.3.4.RELEASE-tuxcare.24.3.4.RELEASE-tuxcare.34.3.4.RELEASE-tuxcare.4 |
4.3.4.RELEASE-tuxcare.5 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 12 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.5, plus listed versions 4.3.4.RELEASE-tuxcare.14.3.4.RELEASE-tuxcare.24.3.4.RELEASE-tuxcare.34.3.4.RELEASE-tuxcare.4 |
4.3.4.RELEASE-tuxcare.5 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 12 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.5, plus listed versions 4.3.4.RELEASE-tuxcare.14.3.4.RELEASE-tuxcare.24.3.4.RELEASE-tuxcare.34.3.4.RELEASE-tuxcare.4 |
4.3.4.RELEASE-tuxcare.5 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 12 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.5, plus listed versions 4.3.4.RELEASE-tuxcare.14.3.4.RELEASE-tuxcare.24.3.4.RELEASE-tuxcare.34.3.4.RELEASE-tuxcare.4 |
4.3.4.RELEASE-tuxcare.5 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 12 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.5, plus listed versions 4.3.4.RELEASE-tuxcare.14.3.4.RELEASE-tuxcare.24.3.4.RELEASE-tuxcare.34.3.4.RELEASE-tuxcare.4 |
4.3.4.RELEASE-tuxcare.5 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
libspring-javaDebian:12 |
before 4.3.19-1 | 4.3.19-1 |
libspring-javaDebian:13 |
before 4.3.19-1 | 4.3.19-1 |
libspring-javaDebian:14 |
before 4.3.19-1 | 4.3.19-1 |
org.springframework:spring-coreMaven |
5.0.0 up to 5.0.6, plus listed versions 5.0.0.RELEASE5.0.1.RELEASE5.0.2.RELEASE5.0.3.RELEASE5.0.4.RELEASE5.0.5.RELEASE |
5.0.6 |
org.springframework:spring-coreMaven |
before 4.3.17, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
4.3.17 |
libspring-javaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2 |
None known |
libspring-javaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1257 is a medium vulnerability (CVSS 6.5) in Pivotal Spring Framework, published May 11, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.02%, the 87th percentile. Fixed in org.springframework:spring-core 5.0.6.
References
securityfocus.com/bid/104260
access.redhat.com/errata/RHSA-2018:1809
oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Show 13 moreShow less
pivotal.io/security/cve-2018-1257
nvd.nist.gov/vuln/detail/CVE-2018-1257
github.com/advisories/GHSA-rcpf-vj53-7h2m
security-tracker.debian.org/tracker/CVE-2018-1257
ubuntu.com/security/CVE-2018-1257
cve.org/CVERecord?id=CVE-2018-1257
Left out here: 78 versions. The JSON record has them.