CVE-2024-38828

mediumpriority · track · 10EPSS 0.007 · 54 %ileexploit · PoCDEEUFRNLUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

3 exploits · PoC

Likely / severe?

0.72% (54th) EPSS

CVSS 5.3 · medium

Is it mine?

80 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · scored 2026-10-27

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · security@vmware.comexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · OSV

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:Psecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USCWE-400USCWE-404US

exploits (3)

Public proof-of-concept and weaponised exploit code.

First-Roman/sprig-mvc-demo-patchThis demo application partially covers the vulnerability CVE-2024-38828PoC · poc_in_github
funcid/CVE-2024-38828funcid/CVE-2024-38828PoC · poc_in_github
topilov/axiom-jdk-test-taskCVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter PoC · poc_in_github

affected products (80)

Products and version ranges known to be affected.

Dell NetWorker <19.13all versionscert_bundDE
HCL Commerce 9.1.0-9.1.19.0all versionscert_bundDEcpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0
IBM InfoSphere Information Server 11.7all versionscert_bundDEcpe:/a:ibm:infosphere_information_server:11.7
IBM Operational Decision Managerall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:-
NetApp ActiveIQ Unified Manager for Linuxall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_linux
NetApp ActiveIQ Unified Manager for Microsoft Windowsall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows
NetApp ActiveIQ Unified Manager for VMware vSphereall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere
SolarWinds Security Event Manager <2025.4all versionscert_bundDE
VMware Tanzu Spring Framework <5.3.42all versionscert_bundDE
Dell Networker< 19.13cert_bundDE
SolarWinds Security Event Manager< 2025.4cert_bundDE
VMware Tanzu Spring Framework< 5.3.42cert_bundDE
Spring Spring5.3.x → 5.3.42enisa_euvdEU
Oracle Application Object Library≤ vers:oracle/>=12.2.5|<=12.2.14ncsc_nlNLcpe:2.3:a:oracle:application_object_library:12.2.5-12.2.14:*:*:*:*:*:*:*
Oracle Application Object Library≤ vers:oracle/>=12.2.3|<=12.2.14ncsc_nlNLcpe:2.3:a:oracle:application_object_library:12.2.3-12.2.14:*:*:*:*:*:*:*
Oracle Applications Framework≤ vers:oracle/>=12.2.3|<=12.2.14ncsc_nlNLcpe:2.3:a:oracle:applications_framework:12.2.3-12.2.14:*:*:*:*:*:*:*
Oracle Applications Technology Stack≤ vers:oracle/>=12.2.3|<=12.2.14ncsc_nlNLcpe:2.3:a:oracle:applications_technology_stack:12.2.3-12.2.14:*:*:*:*:*:*:*
Oracle CRM Technical Foundation≤ vers:oracle/>=12.2.3|<=12.2.14ncsc_nlNLcpe:2.3:a:oracle:crm_technical_foundation:12.2.3-12.2.14:*:*:*:*:*:*:*
Oracle Common Applications≤ vers:oracle/>=12.2.3|<=12.2.14ncsc_nlNLcpe:2.3:a:oracle:common_applications:12.2.3-12.2.14:*:*:*:*:*:*:*
Oracle Configurator≤ vers:oracle/>=12.2.3|<=12.2.14ncsc_nlNLcpe:2.3:a:oracle:configurator:12.2.3-12.2.14:*:*:*:*:*:*:*

showing 20 of 80

advisories (9)

Vendor and ecosystem advisories describing this.

NCSC-2025-0045Kwetsbaarheden verholpen in SAP productenNL2025-02-11csaf · ncsc_nlNL
SAP heeft kwetsbaarheden verholpen in onder andere SAP NetWeaver, BusinessObjects Business Intelligence platform, Enterprise Project Connection en Commerce.
NCSC-2025-0125Kwetsbaarheden verholpen in Oracle E-Business SuiteNL2025-04-16csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle E-Business Suite (Specifiek voor versies 12.2.3 tot 12.2.14).
WID-SEC-W-2024-3473VMware Tanzu Spring Framework: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-11-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2025-0307SAP Patchday Februar 2025: Mehrere SchwachstellenDeutsch2025-02-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in der SAP-Software ausnutzen, um erhöhte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting- und Spoofing-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.
WID-SEC-W-2025-0821Oracle E-Business Suite: Mehrere SchwachstellenDeutsch2025-04-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle E-Business Suite ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2025-1572Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-0559IBM Rational Build Forge: Mehrere SchwachstellenDeutsch2026-03-01csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Rational Build Forge ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Dateien zu manipulieren.
GHSA-w3c8-7r8f-9jp8Spring MVC controller vulnerable to a DoS attack2024-11-18ghsa · osvUS
Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund ncsc_nl osv certfr NVD CVE.org MITRE

published 2024-11-18modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan