{"id":"CVE-2024-38807","aliases":["CLSA-2025-1738627240","CLSA-2026-1770336547","CLSA-2026-1776299674","CLSA-2026-1778460303","CLSA-2026-1780620670","CLSA-2026-1783645398","CLSA-2026-1783904634","CLSA-2026-1783991067","CLSA-2026-1784769561","CLSA-2026-1785291684","CLSA-2026-1790861577","CLSA-2026-1793805334","CLSA-2026-1794258859","CLSA-2026-1794275759","DEBIAN-CVE-2024-38807","EUVD-2024-2526","GHSA-7cj3-x93g-gj76","RHLW-2026-11ab22698dd7c623","ROOT-APP-MAVEN-CVE-2024-38807","UBUNTU-CVE-2024-38807"],"status":"published","title":"CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader","description":"Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00123,"percentile":0.02082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290","CWE-347"],"published":"2024-08-23T08:26:11Z","modified":"2026-11-10T07:15:02Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","fixed_in":["2.7.22","3.0.17","3.1.13","3.2.9","3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","fixed_in":["2.7.22","3.0.17","3.1.13","3.2.9","3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","fixed_in":["2.7.18.tuxcare.4","2.3.6.RELEASE-tuxcare.3","2.7.16-tuxcare.5","2.4.6-tuxcare.7","2.4.5-tuxcare.5"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.springframework.boot:spring-boot-loader","fixed_in":["2.7.18.rhlw-00004"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot-loader","fixed_in":["3.2.0-root.io.1","3.2.0-root.io.2","3.2.0-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot-loader-classic","fixed_in":["3.2.0-root.io.1","3.2.0-root.io.2","3.2.0-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot-loader","fixed_in":["3.2.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot-loader-classic","fixed_in":["3.2.0-aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"last_affected":"2.7.21"},{"fixed":"2.7.22"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"last_affected":"2.7.21"},{"fixed":"2.7.22"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.0.16"},{"fixed":"3.0.17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.0.16"},{"fixed":"3.0.17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"last_affected":"3.1.12"},{"fixed":"3.1.13"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"last_affected":"3.1.12"},{"fixed":"3.1.13"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"last_affected":"3.2.8"},{"fixed":"3.2.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"last_affected":"3.2.8"},{"fixed":"3.2.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"last_affected":"3.3.2"},{"fixed":"3.3.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"last_affected":"3.3.2"},{"fixed":"3.3.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.18"},{"fixed":"2.7.18.tuxcare.4"}]}],"versions":["2.7.18","2.7.18.tuxcare","2.7.18.tuxcare.1","2.7.18.tuxcare.2","2.7.18.tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.8"},{"fixed":"3.1.8-tuxcare.1"}]}],"versions":["3.1.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.8"},{"fixed":"3.1.8-tuxcare.1"}]}],"versions":["3.1.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.8"},{"fixed":"3.1.8-tuxcare.1"}]}],"versions":["3.1.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.15"},{"fixed":"2.6.15-tuxcare.9"}]}],"versions":["2.6.15","2.6.15-tuxcare.2","2.6.15-tuxcare.3","2.6.15-tuxcare.4","2.6.15-tuxcare.5","2.6.15-tuxcare.6","2.6.15-tuxcare.7","2.6.15-tuxcare.8","2.6.15.tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.15"},{"fixed":"2.6.15-tuxcare.9"}]}],"versions":["2.6.15","2.6.15-tuxcare.2","2.6.15-tuxcare.3","2.6.15-tuxcare.4","2.6.15-tuxcare.5","2.6.15-tuxcare.6","2.6.15-tuxcare.7","2.6.15-tuxcare.8","2.6.15.tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.15"},{"fixed":"2.6.15-tuxcare.9"}]}],"versions":["2.6.15","2.6.15-tuxcare.2","2.6.15-tuxcare.3","2.6.15-tuxcare.4","2.6.15-tuxcare.5","2.6.15-tuxcare.6","2.6.15-tuxcare.7","2.6.15-tuxcare.8","2.6.15.tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.6.RELEASE"},{"fixed":"2.3.6.RELEASE-tuxcare.3"}]}],"versions":["2.3.6.RELEASE","2.3.6.RELEASE-tuxcare.1","2.3.6.RELEASE-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.16"},{"fixed":"2.7.16-tuxcare.5"}]}],"versions":["2.7.16","2.7.16-tuxcare.1","2.7.16-tuxcare.2","2.7.16-tuxcare.3","2.7.16-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.13"},{"fixed":"3.0.13-tuxcare.1"}]}],"versions":["3.0.13"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.13"},{"fixed":"3.0.13-tuxcare.1"}]}],"versions":["3.0.13"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.13"},{"fixed":"3.0.13-tuxcare.1"}]}],"versions":["3.0.13"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.13"},{"fixed":"3.0.13-tuxcare.1"}]}],"versions":["3.0.13"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.13"},{"fixed":"3.0.13-tuxcare.1"}]}],"versions":["3.0.13"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.6"},{"fixed":"2.4.6-tuxcare.7"}]}],"versions":["2.4.6","2.4.6-tuxcare.3","2.4.6-tuxcare.4","2.4.6-tuxcare.5","2.4.6-tuxcare.6","2.4.6.tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5"},{"fixed":"2.4.5-tuxcare.5"}]}],"versions":["2.4.5","2.4.5-tuxcare.1","2.4.5-tuxcare.2","2.4.5-tuxcare.3","2.4.5-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.2"}]}],"versions":["2.7.9","2.7.9-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.2"}]}],"versions":["2.7.9","2.7.9-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.2"}]}],"versions":["2.7.9","2.7.9-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.2"}]}],"versions":["2.7.9","2.7.9-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6"},{"fixed":"3.0.6-tuxcare.1"}]}],"versions":["3.0.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6"},{"fixed":"3.0.6-tuxcare.1"}]}],"versions":["3.0.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6"},{"fixed":"3.0.6-tuxcare.1"}]}],"versions":["3.0.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6"},{"fixed":"3.0.6-tuxcare.1"}]}],"versions":["3.0.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6"},{"fixed":"3.0.6-tuxcare.1"}]}],"versions":["3.0.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6"},{"fixed":"3.0.6-tuxcare.1"}]}],"versions":["3.0.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6"},{"fixed":"3.0.6-tuxcare.1"}]}],"versions":["3.0.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-3","4.3.30-4","4.3.30-5","4.3.30-6","5.1.20-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4","4.3.30-5","4.3.30-6","5.1.20-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4","4.3.30-5","4.3.30-6","5.1.20-1"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.22"}]}],"versions":["2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.22"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.17"}]}],"versions":["3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.17"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.13"}]}],"versions":["3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.13"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.9"}]}],"versions":["3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.9"}]}],"versions":["3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}],"versions":["3.3.0","3.3.1","3.3.2"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}],"versions":["3.3.0","3.3.1","3.3.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18.rhlw-00004"}]}],"versions":["1.0.0.RELEASE","1.0.1.RELEASE","1.0.2.RELEASE","1.1.0.RELEASE","1.1.1.RELEASE","1.1.10.RELEASE","1.1.11.RELEASE","1.1.12.RELEASE","1.1.2.RELEASE","1.1.3.RELEASE","1.1.4.RELEASE","1.1.5.RELEASE","1.1.6.RELEASE","1.1.7.RELEASE","1.1.8.RELEASE","1.1.9.RELEASE","1.2.0.RELEASE","1.2.1.RELEASE","1.2.2.RELEASE","1.2.3.RELEASE","1.2.4.RELEASE","1.2.5.RELEASE","1.2.6.RELEASE","1.2.7.RELEASE","1.2.8.RELEASE","1.3.0.RELEASE","1.3.1.RELEASE","1.3.2.RELEASE","1.3.3.RELEASE","1.3.4.RELEASE","1.3.5.RELEASE","1.3.6.RELEASE","1.3.7.RELEASE","1.3.8.RELEASE","1.4.0.RELEASE","1.4.1.RELEASE","1.4.2.RELEASE","1.4.3.RELEASE","1.4.4.RELEASE","1.4.5.RELEASE","1.4.6.RELEASE","1.4.7.RELEASE","1.5.0.RELEASE","1.5.1.RELEASE","1.5.10.RELEASE","1.5.11.RELEASE","1.5.12.RELEASE","1.5.13.RELEASE","1.5.14.RELEASE","1.5.15.RELEASE","1.5.16.RELEASE","1.5.17.RELEASE","1.5.18.RELEASE","1.5.19.RELEASE","1.5.2.RELEASE","1.5.20.RELEASE","1.5.21.RELEASE","1.5.22.RELEASE","1.5.3.RELEASE","1.5.4.RELEASE","1.5.5.RELEASE","1.5.6.RELEASE","1.5.7.RELEASE","1.5.8.RELEASE","1.5.9.RELEASE","2.0.0.RELEASE","2.0.1.RELEASE","2.0.2.RELEASE","2.0.3.RELEASE","2.0.4.RELEASE","2.0.5.RELEASE","2.0.6.RELEASE","2.0.7.RELEASE","2.0.8.RELEASE","2.0.9.RELEASE","2.1.0.RELEASE","2.1.1.RELEASE","2.1.10.RELEASE","2.1.11.RELEASE","2.1.12.RELEASE","2.1.13.RELEASE","2.1.14.RELEASE","2.1.15.RELEASE","2.1.16.RELEASE","2.1.17.RELEASE","2.1.18.RELEASE","2.1.2.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE","2.1.7.RELEASE","2.1.8.RELEASE","2.1.9.RELEASE","2.2.0.RELEASE","2.2.1.RELEASE","2.2.10.RELEASE","2.2.11.RELEASE","2.2.12.RELEASE","2.2.13.RELEASE","2.2.2.RELEASE","2.2.3.RELEASE","2.2.4.RELEASE","2.2.5.RELEASE","2.2.6.RELEASE","2.2.7.RELEASE","2.2.8.RELEASE","2.2.9.RELEASE","2.3.0.RELEASE","2.3.1.RELEASE","2.3.10.RELEASE","2.3.11.RELEASE","2.3.12.RELEASE","2.3.2.RELEASE","2.3.3.RELEASE","2.3.4.RELEASE","2.3.5.RELEASE","2.3.6.RELEASE","2.3.7.RELEASE","2.3.8.RELEASE","2.3.9.RELEASE","2.4.0","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.14","2.5.15","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-root.io.1"},{"fixed":"3.2.0-root.io.2"},{"fixed":"3.2.0-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-root.io.1"},{"fixed":"3.2.0-root.io.2"},{"fixed":"3.2.0-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot-loader-classic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6.RELEASE-7","3.0.6.RELEASE-8","3.0.6.RELEASE-9","3.0.6.RELEASE-10","3.0.6.RELEASE-11","3.0.6.RELEASE-12","3.0.6.RELEASE-13","3.0.6.RELEASE-13ubuntu0.1~esm1","3.0.6.RELEASE-13ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13-3","3.2.13-4","3.2.13-5","3.2.13-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.11-1","4.3.12-1","4.3.13-2","4.3.14-1","4.3.22-1~18.04","4.3.22-1~18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.22-4","4.3.22-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-1","4.3.30-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2ubuntu1","4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]}],"products":[{"vendor":"spring","product":"spring boot"}],"references":[{"url":"https://spring.io/security/cve-2024-38807","tags":["web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20250117-0006/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38807","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250117-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7cj3-x93g-gj76","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-38807","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-boot","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-38807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38807","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-38807","title":"CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader","description":"Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.","status":"published","published":"2024-08-23T08:26:11.826Z","modified":"2025-03-27T16:36:21.258Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-347","CWE-290"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-2526","description":"Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.","status":"published","published":"2024-08-23T08:26:11Z","modified":"2025-03-27T16:36:21Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:49.093928Z"}],"ghsa":[{"id":"GHSA-7cj3-x93g-gj76","title":"Signature forgery in Spring Boot's Loader","description":"Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.","status":"published","published":"2024-08-23T09:30:35Z","modified":"2025-03-27T23:38:51Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-290","CWE-347"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2024-38807","description":"Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.","status":"published","published":"2024-08-23T09:15:07.453Z","modified":"2026-06-17T07:41:05.037Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-290","CWE-347"],"updated_at":"2026-11-02T14:10:19.870727Z"}],"osv":[{"id":"DEBIAN-CVE-2024-38807","description":"Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.","status":"published","published":"2024-08-23T09:15:07.453Z","modified":"2026-11-02T12:02:43.354437493Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"GHSA-7cj3-x93g-gj76","title":"Signature forgery in Spring Boot's Loader","description":"Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.","status":"published","published":"2024-08-23T09:30:35Z","modified":"2025-03-27T23:55:09.313471Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"},{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-290","CWE-347"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2024-38807","description":"Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.","status":"published","published":"2024-08-23T09:15:00Z","modified":"2026-10-17T12:56:37.164224148Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"CLSA-2025-1738627240","title":"TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)","description":"TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.7.18.tuxcare.4.","status":"published","published":"2026-08-04T14:52:03Z","modified":"2026-11-02T19:45:06.280127318Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1770336547","title":"TuxCare security update for org.springframework.boot (2 CVEs)","description":"TuxCare rebuilt 3 org.springframework.boot packages to address 2 CVEs. Fixed in 3.1.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.311621341Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1776299674","title":"TuxCare security update for org.springframework.boot (2 CVEs)","description":"TuxCare rebuilt 3 org.springframework.boot packages to address 2 CVEs. Fixed in 2.6.15-tuxcare.9.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-11-02T19:45:23.282688213Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1778460303","title":"TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)","description":"TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.3.6.RELEASE-tuxcare.3.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-11-02T19:45:28.881448053Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1780620670","title":"TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)","description":"TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.7.16-tuxcare.5.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-11-02T19:45:37.601797275Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1783645398","title":"TuxCare security update for org.springframework.boot (3 CVEs)","description":"TuxCare rebuilt 5 org.springframework.boot packages to address 3 CVEs. Fixed in 3.0.13-tuxcare.1.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-11-02T19:45:41.875881562Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1783904634","title":"TuxCare security update for org.springframework.boot (6 CVEs)","description":"TuxCare rebuilt 6 org.springframework.boot packages to address 6 CVEs. Fixed in 2.5.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-11-02T19:45:40.131558266Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1783991067","title":"TuxCare security update for org.springframework.boot (9 CVEs)","description":"TuxCare rebuilt 7 org.springframework.boot packages to address 9 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-11-02T19:45:38.77651252Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1784769561","title":"TuxCare security update for org.springframework.amqp (2 CVEs)","description":"TuxCare rebuilt 7 org.springframework.amqp packages to address 2 CVEs. Fixed in 3.1.8-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:48Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291684","title":"TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)","description":"TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.4.6-tuxcare.7.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-11-02T19:45:43.263992336Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1790861577","title":"TuxCare security update for org.springframework.boot:spring-boot-loader (1 CVE)","description":"TuxCare rebuilt org.springframework.boot:spring-boot-loader to address 1 CVE. Fixed in 2.4.5-tuxcare.5.","status":"published","published":"2026-10-01T13:32:57Z","modified":"2026-11-02T19:46:25.357769933Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1793805334","title":"TuxCare security update for org.springframework.boot (5 CVEs)","description":"TuxCare rebuilt 4 org.springframework.boot packages to address 5 CVEs. Fixed in 2.7.9-tuxcare.2.","status":"published","published":"2026-11-04T16:15:36Z","modified":"2026-11-04T19:00:38.195749201Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1794258859","title":"TuxCare security update for org.springframework.boot (7 CVEs)","description":"TuxCare rebuilt 7 org.springframework.boot packages to address 7 CVEs. Fixed in 3.0.6-tuxcare.1.","status":"published","published":"2026-11-09T22:14:20Z","modified":"2026-11-10T01:15:03.458851152Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794275759","title":"TuxCare security update for org.springframework.boot (7 CVEs)","description":"TuxCare rebuilt 5 org.springframework.boot packages to address 7 CVEs. Fixed in 2.1.18.RELEASE-tuxcare.1.","status":"published","published":"2026-11-10T02:56:00Z","modified":"2026-11-10T07:15:02.338357049Z","updated_at":"2026-11-10T07:24:16.839298Z"},{"id":"CVE-2024-38807","description":"Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.","status":"published","published":"2024-08-23T09:15:07Z","modified":"2026-04-10T05:13:30.82993Z","updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"RHLW-2026-11ab22698dd7c623","title":"Lightwell Security Advisory: spring-boot-loader 2.7.18.rhlw-00004","description":"Red Hat Lightwell has released org.springframework.boot:spring-boot-loader 2.7.18.rhlw-00004 with a backported security fix.\n\nCVE-2024-38807: Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.\n\nThis patched artifact is a drop-in replacement for org.springframework.boot:spring-boot-loader 2.7.18 from Maven Central.","status":"published","published":"2026-10-12T16:59:37Z","modified":"2026-10-27T04:00:05.451641553Z","updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-CVE-2024-38807","title":"CVE-2024-38807 in io.root.org.springframework.boot:spring-boot-loader - Patched by Root","description":"Root has patched CVE-2024-38807 in the io.root.org.springframework.boot:spring-boot-loader package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-18T09:50:42Z","modified":"2026-06-18T13:45:18.51686852Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}