CVE-2024-38809
highpriority · track · 0EPSS 0.009 · 58 %ileDEEUFRNLRUUSEPSS · scored 2026-10-22
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.9–8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (65)
Products and version ranges known to be affected.
- IBM InfoSphere Information Server 11.7all versionscert_bundDEcpe:/a:ibm:infosphere_information_server:11.7
- IBM Operational Decision Manager 8.11.xall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.11.x
- IBM Operational Decision Manager 8.12.xall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.12.x
- IBM Operational Decision Manager 9.0.0all versionscert_bundDEcpe:/a:ibm:operational_decision_manager:9.0.0
- IBM SPSS Collaboration and Deployment Servicesall versionscert_bundDEcpe:/a:ibm:spss:collaboration_and_deployment_services
- Red Hat JBoss Enterprise Application Platform Quarkusall versionscert_bundDEcpe:/a:redhat:jboss_enterprise_application_platform:quarkus
advisories (7)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0418Kwetsbaarheden verholpen in Oracle AnalyticsNL2024-10-17csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Analytics producten.
- NCSC-2025-0021Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communicatieproducten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Network Function en Oracle Communications Order and Service Management.
- NCSC-2025-0028Kwetsbaarheden verholpen in Oracle AnalyticsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Analytics producten, zoals Business Intelligence, Analytics Desktop en BI Publisher.
- WID-SEC-W-2024-1853VMware Tanzu Spring Framework: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-08-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2024-3180Apache Camel und mehrere Red Hat Produkte: Mehrere SchwachstellenDeutsch2024-10-14csaf · cert_bundDE
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Apache Camel und in mehreren Red Hat-Produkten ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen preiszugeben und beliebigen Code auszuführen.
- GHSA-2rmj-mq67-h97gSpring Framework DoS via conditional HTTP request2024-09-24ghsa · osvUS
### Description Applications that parse ETags from `If-Match` or `If-None-Match` request headers are vulnerable to DoS attack. ### Affected Spring Products and Versions org.springframework:spring-web in versions 6.1.0 through 6.1.11 6.0.0 through 6.0.22 5.3.0 through 5.3.37 Older, unsupported versions are also affected ### Mitigation Users of affected versions should upgrade to the corresponding fixed version. 6.1.x -> 6.1.12 6.0.x -> 6.0.23 5.3.x -> 5.3.38 No other mitigation steps are necessary. Users of older, unsupported versions could enforce a size limit on `If-Match` and `If-None-Match` headers, e.g. through a Filter.
- CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-38809cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-38809/cnnvd
- https://spring.io/security/cve-2024-38809cnnvd
- https://vigilance.fr/vulnerability/Spring-Framework-denial-of-service-via-Conditional-HTTP-Request-44948cnnvd
- https://www.oracle.com/security-alerts/cpujan2025.htmlcnnvd
- https://www.oracle.com/security-alerts/cpuoct2024.htmlcnnvd
- https://spring.io/security/cve-2024-38809enisa_euvd
- https://security.netapp.com/advisory/ntap-20240920-0003/nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan