CVE-2018-15756: debian debian_linux
Vulnerability summary
CVE-2018-15756 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 9.21% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 18-10-2018PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
9.21%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 9.21% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle38 products
- agile_product_lifecycle_management9.3.3 | 9.3.4 | 9.3.5 | 9.3.6
- communications_brm_-_elastic_charging_engine11.3 | 12.0
- communications_converged_application_server_-_service_controller6.0 | 6.1
- communications_diameter_signaling_router8.0.0 | 8.1 | 8.2 | 8.2.1
- communications_element_manager8.1.1 | 8.2.0 | 8.2.1
Debian2 products
- libspring-java< 4.3.21-1
- debian_linuxEOL9.0
Org.springframework1 product
- spring-core≥ 5.1.0.RELEASE, < 5.1.1.RELEASE | ≥ 5.0.0.RELEASE, < 5.0.10.RELEASE | ≥ 4.2.0.RELEASE, < 4.3.20.RELEASE
Pivotal1 product
- spring framework5.1 | ≥ 5.0.0, ≤ 5.0.9 | ≥ 4.3, ≤ 4.3.19
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework≥ 4.2.0, < 4.3.20 | ≥ 5.0.0, < 5.0.10 | 5.1.0
6 vendors · 44 products
References
35 linksShow all 35 references
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCPatchThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2021/04/msg00022.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB