--- id: CVE-2018-15756 title: >- Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRe… summary: >- Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRe… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' vendor: vmware product: spring_framework affected: - 'spring_framework >= 4.2.0, < 4.3.20' - 'spring_framework >= 5.0.0, < 5.0.10' - spring_framework = 5.1.0 - agile_product_lifecycle_management = 9.3.3 - agile_product_lifecycle_management = 9.3.4 - agile_product_lifecycle_management = 9.3.5 - agile_product_lifecycle_management = 9.3.6 - communications_brm_-_elastic_charging_engine = 11.3 - communications_brm_-_elastic_charging_engine = 12.0 - communications_converged_application_server_-_service_controller = 6.0 - communications_converged_application_server_-_service_controller = 6.1 - communications_diameter_signaling_router = 8.0.0 - communications_diameter_signaling_router = 8.1 - communications_diameter_signaling_router = 8.2 - communications_diameter_signaling_router = 8.2.1 - communications_element_manager = 8.1.1 - communications_element_manager = 8.2.0 - communications_element_manager = 8.2.1 - communications_online_mediation_controller = 6.1 - communications_session_report_manager = 8.0.0 - communications_session_report_manager = 8.1.0 - communications_session_report_manager = 8.1.1 - communications_session_report_manager = 8.2.0 - communications_session_report_manager = 8.2.1 - communications_session_route_manager = 8.0.0 - communications_session_route_manager = 8.1.0 - communications_session_route_manager = 8.1.1 - communications_session_route_manager = 8.2.0 - communications_session_route_manager = 8.2.1 - communications_unified_inventory_management = 7.3 - communications_unified_inventory_management = 7.4.0 - endeca_information_discovery_integrator = 3.2.0 - enterprise_manager_for_fusion_applications = 13.3.0.0 - enterprise_manager_ops_center = 12.3.3 - 'financial_services_analytical_applications_infrastructure >= 8.0.2, <= 8.0.8' - flexcube_private_banking = 12.0.1 - flexcube_private_banking = 12.0.3 - flexcube_private_banking = 12.1.0 - goldengate_application_adapters = 12.3.2.1.0 - healthcare_master_person_index = 3.0 - healthcare_master_person_index = 4.0.2 - identity_manager_connector = 9.0 - insurance_calculation_engine = 9.7 - insurance_calculation_engine = 10.0 - insurance_calculation_engine = 10.1 - insurance_calculation_engine = 10.2 - insurance_policy_administration_j2ee = 10.0 - insurance_policy_administration_j2ee = 10.1 - insurance_policy_administration_j2ee = 10.2 - insurance_policy_administration_j2ee = 10.2.0 - insurance_policy_administration_j2ee = 10.2.4 - insurance_policy_administration_j2ee = 11.0 - insurance_policy_administration_j2ee = 11.1.0 - insurance_policy_administration_j2ee = 11.2.0 - insurance_rules_palette = 10.0 - insurance_rules_palette = 10.1 - insurance_rules_palette = 10.2 - insurance_rules_palette = 10.2.0 - insurance_rules_palette = 10.2.4 - insurance_rules_palette = 11.0 - insurance_rules_palette = 11.0.2 - insurance_rules_palette = 11.1.0 - insurance_rules_palette = 11.2.0 - mysql_enterprise_monitor <= 4.0.12 - 'mysql_enterprise_monitor >= 8.0.0, <= 8.0.20' - primavera_analytics = 18.8 - primavera_gateway = 15.2 - primavera_gateway = 16.2 - primavera_gateway = 17.12 - primavera_gateway = 18.8.0 - rapid_planning = 12.1 - rapid_planning = 12.2 - retail_advanced_inventory_planning = 15.0 - retail_assortment_planning = 15.0 - retail_assortment_planning = 16.0 - retail_clearance_optimization_engine = 14.0.5 - retail_financial_integration = 14.0 - retail_financial_integration = 14.1 - retail_financial_integration = 15.0 - retail_financial_integration = 16.0 - retail_integration_bus = 15.0 - retail_integration_bus = 15.0.3 - retail_integration_bus = 16.0 - retail_integration_bus = 16.0.3 - retail_invoice_matching = 12.0 - retail_invoice_matching = 13.0 - retail_invoice_matching = 13.1 - retail_invoice_matching = 13.2 - retail_invoice_matching = 14.0 - retail_invoice_matching = 14.1 - retail_markdown_optimization = 13.4.4 - retail_order_broker = 5.1 - retail_order_broker = 5.2 - retail_order_broker = 15.0 - retail_order_broker = 16.0 - retail_predictive_application_server = 14.0.3 - retail_predictive_application_server = 14.0.3.26 - retail_predictive_application_server = 14.1.3 - retail_predictive_application_server = 14.1.3.37 - retail_predictive_application_server = 15.0.3 patched: - spring_framework 5.0.10 published: '2018-10-18' updated: '2026-08-25' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-15756' references: - url: 'http://www.securityfocus.com/bid/105703' label: security_alert@emc.com - url: >- https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%40%3Cissues.activemq.apache.org%3E label: security_alert@emc.com - url: >- https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%40%3Cissues.activemq.apache.org%3E label: security_alert@emc.com - url: >- https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%40%3Cissues.activemq.apache.org%3E label: security_alert@emc.com - url: >- https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%40%3Cissues.activemq.apache.org%3E label: security_alert@emc.com - url: >- https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%40%3Cissues.activemq.apache.org%3E label: security_alert@emc.com - url: >- https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%40%3Cissues.activemq.apache.org%3E label: security_alert@emc.com - url: >- https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%40%3Cissues.activemq.apache.org%3E label: security_alert@emc.com - url: >- https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%40%3Cissues.activemq.apache.org%3E label: security_alert@emc.com - url: >- https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%40%3Cissues.activemq.apache.org%3E label: security_alert@emc.com - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html' label: security_alert@emc.com - url: 'https://pivotal.io/security/cve-2018-15756' label: security_alert@emc.com - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: security_alert@emc.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html label: security_alert@emc.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: security_alert@emc.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html label: security_alert@emc.com - url: 'http://www.securityfocus.com/bid/105703' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%40%3Cissues.activemq.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%40%3Cissues.activemq.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%40%3Cissues.activemq.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%40%3Cissues.activemq.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%40%3Cissues.activemq.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%40%3Cissues.activemq.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%40%3Cissues.activemq.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%40%3Cissues.activemq.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%40%3Cissues.activemq.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://pivotal.io/security/cve-2018-15756' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.09207 epssPercentile: 0.95105 ingestedAt: '2026-08-25T17:29:29.192Z' --- ## Overview Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable. ## Affected - `spring_framework >= 4.2.0, < 4.3.20` - `spring_framework >= 5.0.0, < 5.0.10` - `spring_framework = 5.1.0` - `agile_product_lifecycle_management = 9.3.3` - `agile_product_lifecycle_management = 9.3.4` - `agile_product_lifecycle_management = 9.3.5` - `agile_product_lifecycle_management = 9.3.6` - `communications_brm_-_elastic_charging_engine = 11.3` - `communications_brm_-_elastic_charging_engine = 12.0` - `communications_converged_application_server_-_service_controller = 6.0` - `communications_converged_application_server_-_service_controller = 6.1` - `communications_diameter_signaling_router = 8.0.0` - `communications_diameter_signaling_router = 8.1` - `communications_diameter_signaling_router = 8.2` - `communications_diameter_signaling_router = 8.2.1` - `communications_element_manager = 8.1.1` - `communications_element_manager = 8.2.0` - `communications_element_manager = 8.2.1` - `communications_online_mediation_controller = 6.1` - `communications_session_report_manager = 8.0.0` - `communications_session_report_manager = 8.1.0` - `communications_session_report_manager = 8.1.1` - `communications_session_report_manager = 8.2.0` - `communications_session_report_manager = 8.2.1` - `communications_session_route_manager = 8.0.0` - `communications_session_route_manager = 8.1.0` - `communications_session_route_manager = 8.1.1` - `communications_session_route_manager = 8.2.0` - `communications_session_route_manager = 8.2.1` - `communications_unified_inventory_management = 7.3` - `communications_unified_inventory_management = 7.4.0` - `endeca_information_discovery_integrator = 3.2.0` - `enterprise_manager_for_fusion_applications = 13.3.0.0` - `enterprise_manager_ops_center = 12.3.3` - `financial_services_analytical_applications_infrastructure >= 8.0.2, <= 8.0.8` - `flexcube_private_banking = 12.0.1` - `flexcube_private_banking = 12.0.3` - `flexcube_private_banking = 12.1.0` - `goldengate_application_adapters = 12.3.2.1.0` - `healthcare_master_person_index = 3.0` - `healthcare_master_person_index = 4.0.2` - `identity_manager_connector = 9.0` - `insurance_calculation_engine = 9.7` - `insurance_calculation_engine = 10.0` - `insurance_calculation_engine = 10.1` - `insurance_calculation_engine = 10.2` - `insurance_policy_administration_j2ee = 10.0` - `insurance_policy_administration_j2ee = 10.1` - `insurance_policy_administration_j2ee = 10.2` - `insurance_policy_administration_j2ee = 10.2.0` - `insurance_policy_administration_j2ee = 10.2.4` - `insurance_policy_administration_j2ee = 11.0` - `insurance_policy_administration_j2ee = 11.1.0` - `insurance_policy_administration_j2ee = 11.2.0` - `insurance_rules_palette = 10.0` - `insurance_rules_palette = 10.1` - `insurance_rules_palette = 10.2` - `insurance_rules_palette = 10.2.0` - `insurance_rules_palette = 10.2.4` - `insurance_rules_palette = 11.0` - `insurance_rules_palette = 11.0.2` - `insurance_rules_palette = 11.1.0` - `insurance_rules_palette = 11.2.0` - `mysql_enterprise_monitor <= 4.0.12` - `mysql_enterprise_monitor >= 8.0.0, <= 8.0.20` - `primavera_analytics = 18.8` - `primavera_gateway = 15.2` - `primavera_gateway = 16.2` - `primavera_gateway = 17.12` - `primavera_gateway = 18.8.0` - `rapid_planning = 12.1` - `rapid_planning = 12.2` - `retail_advanced_inventory_planning = 15.0` - `retail_assortment_planning = 15.0` - `retail_assortment_planning = 16.0` - `retail_clearance_optimization_engine = 14.0.5` - `retail_financial_integration = 14.0` - `retail_financial_integration = 14.1` - `retail_financial_integration = 15.0` - `retail_financial_integration = 16.0` - `retail_integration_bus = 15.0` - `retail_integration_bus = 15.0.3` - `retail_integration_bus = 16.0` - `retail_integration_bus = 16.0.3` - `retail_invoice_matching = 12.0` - `retail_invoice_matching = 13.0` - `retail_invoice_matching = 13.1` - `retail_invoice_matching = 13.2` - `retail_invoice_matching = 14.0` - `retail_invoice_matching = 14.1` - `retail_markdown_optimization = 13.4.4` - `retail_order_broker = 5.1` - `retail_order_broker = 5.2` - `retail_order_broker = 15.0` - `retail_order_broker = 16.0` - `retail_predictive_application_server = 14.0.3` - `retail_predictive_application_server = 14.0.3.26` - `retail_predictive_application_server = 14.1.3` - `retail_predictive_application_server = 14.1.3.37` - `retail_predictive_application_server = 15.0.3` ## Remediation Upgrade past the affected range: - `spring_framework 5.0.10`