{"id":"CVE-2018-15756","title":"Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRe…","summary":"Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRe…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"vmware","product":"spring_framework","affected":["spring_framework >= 4.2.0, < 4.3.20","spring_framework >= 5.0.0, < 5.0.10","spring_framework = 5.1.0","agile_product_lifecycle_management = 9.3.3","agile_product_lifecycle_management = 9.3.4","agile_product_lifecycle_management = 9.3.5","agile_product_lifecycle_management = 9.3.6","communications_brm_-_elastic_charging_engine = 11.3","communications_brm_-_elastic_charging_engine = 12.0","communications_converged_application_server_-_service_controller = 6.0","communications_converged_application_server_-_service_controller = 6.1","communications_diameter_signaling_router = 8.0.0","communications_diameter_signaling_router = 8.1","communications_diameter_signaling_router = 8.2","communications_diameter_signaling_router = 8.2.1","communications_element_manager = 8.1.1","communications_element_manager = 8.2.0","communications_element_manager = 8.2.1","communications_online_mediation_controller = 6.1","communications_session_report_manager = 8.0.0","communications_session_report_manager = 8.1.0","communications_session_report_manager = 8.1.1","communications_session_report_manager = 8.2.0","communications_session_report_manager = 8.2.1","communications_session_route_manager = 8.0.0","communications_session_route_manager = 8.1.0","communications_session_route_manager = 8.1.1","communications_session_route_manager = 8.2.0","communications_session_route_manager = 8.2.1","communications_unified_inventory_management = 7.3","communications_unified_inventory_management = 7.4.0","endeca_information_discovery_integrator = 3.2.0","enterprise_manager_for_fusion_applications = 13.3.0.0","enterprise_manager_ops_center = 12.3.3","financial_services_analytical_applications_infrastructure >= 8.0.2, <= 8.0.8","flexcube_private_banking = 12.0.1","flexcube_private_banking = 12.0.3","flexcube_private_banking = 12.1.0","goldengate_application_adapters = 12.3.2.1.0","healthcare_master_person_index = 3.0","healthcare_master_person_index = 4.0.2","identity_manager_connector = 9.0","insurance_calculation_engine = 9.7","insurance_calculation_engine = 10.0","insurance_calculation_engine = 10.1","insurance_calculation_engine = 10.2","insurance_policy_administration_j2ee = 10.0","insurance_policy_administration_j2ee = 10.1","insurance_policy_administration_j2ee = 10.2","insurance_policy_administration_j2ee = 10.2.0","insurance_policy_administration_j2ee = 10.2.4","insurance_policy_administration_j2ee = 11.0","insurance_policy_administration_j2ee = 11.1.0","insurance_policy_administration_j2ee = 11.2.0","insurance_rules_palette = 10.0","insurance_rules_palette = 10.1","insurance_rules_palette = 10.2","insurance_rules_palette = 10.2.0","insurance_rules_palette = 10.2.4","insurance_rules_palette = 11.0","insurance_rules_palette = 11.0.2","insurance_rules_palette = 11.1.0","insurance_rules_palette = 11.2.0","mysql_enterprise_monitor <= 4.0.12","mysql_enterprise_monitor >= 8.0.0, <= 8.0.20","primavera_analytics = 18.8","primavera_gateway = 15.2","primavera_gateway = 16.2","primavera_gateway = 17.12","primavera_gateway = 18.8.0","rapid_planning = 12.1","rapid_planning = 12.2","retail_advanced_inventory_planning = 15.0","retail_assortment_planning = 15.0","retail_assortment_planning = 16.0","retail_clearance_optimization_engine = 14.0.5","retail_financial_integration = 14.0","retail_financial_integration = 14.1","retail_financial_integration = 15.0","retail_financial_integration = 16.0","retail_integration_bus = 15.0","retail_integration_bus = 15.0.3","retail_integration_bus = 16.0","retail_integration_bus = 16.0.3","retail_invoice_matching = 12.0","retail_invoice_matching = 13.0","retail_invoice_matching = 13.1","retail_invoice_matching = 13.2","retail_invoice_matching = 14.0","retail_invoice_matching = 14.1","retail_markdown_optimization = 13.4.4","retail_order_broker = 5.1","retail_order_broker = 5.2","retail_order_broker = 15.0","retail_order_broker = 16.0","retail_predictive_application_server = 14.0.3","retail_predictive_application_server = 14.0.3.26","retail_predictive_application_server = 14.1.3","retail_predictive_application_server = 14.1.3.37","retail_predictive_application_server = 15.0.3"],"patched":["spring_framework 5.0.10"],"published":"2018-10-18","updated":"2026-08-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-15756","references":[{"url":"http://www.securityfocus.com/bid/105703","label":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%40%3Cissues.activemq.apache.org%3E","label":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%40%3Cissues.activemq.apache.org%3E","label":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%40%3Cissues.activemq.apache.org%3E","label":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%40%3Cissues.activemq.apache.org%3E","label":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%40%3Cissues.activemq.apache.org%3E","label":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%40%3Cissues.activemq.apache.org%3E","label":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%40%3Cissues.activemq.apache.org%3E","label":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%40%3Cissues.activemq.apache.org%3E","label":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%40%3Cissues.activemq.apache.org%3E","label":"security_alert@emc.com"},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","label":"security_alert@emc.com"},{"url":"https://pivotal.io/security/cve-2018-15756","label":"security_alert@emc.com"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","label":"security_alert@emc.com"},{"url":"http://www.securityfocus.com/bid/105703","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%40%3Cissues.activemq.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%40%3Cissues.activemq.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%40%3Cissues.activemq.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%40%3Cissues.activemq.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%40%3Cissues.activemq.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%40%3Cissues.activemq.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%40%3Cissues.activemq.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%40%3Cissues.activemq.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%40%3Cissues.activemq.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pivotal.io/security/cve-2018-15756","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.09207,"epssPercentile":0.95169,"ingestedAt":"2026-08-25T17:29:29.192Z","slug":"CVE-2018-15756","body":"## Overview\n\nSpring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.\n\n## Affected\n\n- `spring_framework >= 4.2.0, < 4.3.20`\n- `spring_framework >= 5.0.0, < 5.0.10`\n- `spring_framework = 5.1.0`\n- `agile_product_lifecycle_management = 9.3.3`\n- `agile_product_lifecycle_management = 9.3.4`\n- `agile_product_lifecycle_management = 9.3.5`\n- `agile_product_lifecycle_management = 9.3.6`\n- `communications_brm_-_elastic_charging_engine = 11.3`\n- `communications_brm_-_elastic_charging_engine = 12.0`\n- `communications_converged_application_server_-_service_controller = 6.0`\n- `communications_converged_application_server_-_service_controller = 6.1`\n- `communications_diameter_signaling_router = 8.0.0`\n- `communications_diameter_signaling_router = 8.1`\n- `communications_diameter_signaling_router = 8.2`\n- `communications_diameter_signaling_router = 8.2.1`\n- `communications_element_manager = 8.1.1`\n- `communications_element_manager = 8.2.0`\n- `communications_element_manager = 8.2.1`\n- `communications_online_mediation_controller = 6.1`\n- `communications_session_report_manager = 8.0.0`\n- `communications_session_report_manager = 8.1.0`\n- `communications_session_report_manager = 8.1.1`\n- `communications_session_report_manager = 8.2.0`\n- `communications_session_report_manager = 8.2.1`\n- `communications_session_route_manager = 8.0.0`\n- `communications_session_route_manager = 8.1.0`\n- `communications_session_route_manager = 8.1.1`\n- `communications_session_route_manager = 8.2.0`\n- `communications_session_route_manager = 8.2.1`\n- `communications_unified_inventory_management = 7.3`\n- `communications_unified_inventory_management = 7.4.0`\n- `endeca_information_discovery_integrator = 3.2.0`\n- `enterprise_manager_for_fusion_applications = 13.3.0.0`\n- `enterprise_manager_ops_center = 12.3.3`\n- `financial_services_analytical_applications_infrastructure >= 8.0.2, <= 8.0.8`\n- `flexcube_private_banking = 12.0.1`\n- `flexcube_private_banking = 12.0.3`\n- `flexcube_private_banking = 12.1.0`\n- `goldengate_application_adapters = 12.3.2.1.0`\n- `healthcare_master_person_index = 3.0`\n- `healthcare_master_person_index = 4.0.2`\n- `identity_manager_connector = 9.0`\n- `insurance_calculation_engine = 9.7`\n- `insurance_calculation_engine = 10.0`\n- `insurance_calculation_engine = 10.1`\n- `insurance_calculation_engine = 10.2`\n- `insurance_policy_administration_j2ee = 10.0`\n- `insurance_policy_administration_j2ee = 10.1`\n- `insurance_policy_administration_j2ee = 10.2`\n- `insurance_policy_administration_j2ee = 10.2.0`\n- `insurance_policy_administration_j2ee = 10.2.4`\n- `insurance_policy_administration_j2ee = 11.0`\n- `insurance_policy_administration_j2ee = 11.1.0`\n- `insurance_policy_administration_j2ee = 11.2.0`\n- `insurance_rules_palette = 10.0`\n- `insurance_rules_palette = 10.1`\n- `insurance_rules_palette = 10.2`\n- `insurance_rules_palette = 10.2.0`\n- `insurance_rules_palette = 10.2.4`\n- `insurance_rules_palette = 11.0`\n- `insurance_rules_palette = 11.0.2`\n- `insurance_rules_palette = 11.1.0`\n- `insurance_rules_palette = 11.2.0`\n- `mysql_enterprise_monitor <= 4.0.12`\n- `mysql_enterprise_monitor >= 8.0.0, <= 8.0.20`\n- `primavera_analytics = 18.8`\n- `primavera_gateway = 15.2`\n- `primavera_gateway = 16.2`\n- `primavera_gateway = 17.12`\n- `primavera_gateway = 18.8.0`\n- `rapid_planning = 12.1`\n- `rapid_planning = 12.2`\n- `retail_advanced_inventory_planning = 15.0`\n- `retail_assortment_planning = 15.0`\n- `retail_assortment_planning = 16.0`\n- `retail_clearance_optimization_engine = 14.0.5`\n- `retail_financial_integration = 14.0`\n- `retail_financial_integration = 14.1`\n- `retail_financial_integration = 15.0`\n- `retail_financial_integration = 16.0`\n- `retail_integration_bus = 15.0`\n- `retail_integration_bus = 15.0.3`\n- `retail_integration_bus = 16.0`\n- `retail_integration_bus = 16.0.3`\n- `retail_invoice_matching = 12.0`\n- `retail_invoice_matching = 13.0`\n- `retail_invoice_matching = 13.1`\n- `retail_invoice_matching = 13.2`\n- `retail_invoice_matching = 14.0`\n- `retail_invoice_matching = 14.1`\n- `retail_markdown_optimization = 13.4.4`\n- `retail_order_broker = 5.1`\n- `retail_order_broker = 5.2`\n- `retail_order_broker = 15.0`\n- `retail_order_broker = 16.0`\n- `retail_predictive_application_server = 14.0.3`\n- `retail_predictive_application_server = 14.0.3.26`\n- `retail_predictive_application_server = 14.1.3`\n- `retail_predictive_application_server = 14.1.3.37`\n- `retail_predictive_application_server = 15.0.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `spring_framework 5.0.10`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":41.3,"likelihood":1.8,"exploitation":0,"ransomware":0},"changes":[]}