Back to CVE records
High 7.5HealthcarePublished Oct 18, 2018
CVE-2018-15756DoS Attack via Range Requests
Updated under an hour ago ()
Does this affect you?
It affects Pivotal Spring framework and 40 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 9.21%, higher than 95% of scored CVEs.
Do this next
Start free and add your stack
Free account, 1 product
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
- CVSS
- 7.5 HIGH (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 9.21% (percentile 95)
- Assigned by
- dell
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Pivotal Spring framework pivotal:spring_framework (from the name) | 5.1; from 5.0.0 through 5.0.9; from 4.3 through 4.3.19 | CNA record |
vmware spring_framework vmware:spring_framework | from 4.2.0 before 4.3.20; from 5.0.0 before 5.0.10; 5.1.0 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.3; 9.3.4; 9.3.5; 9.3.6 | NVD |
oracle communications_brm_-_elastic_charging_engine oracle:communications_brm_-_elastic_charging_engine | 11.3; 12.0 | NVD |
oracle communications_converged_application_server_-_service_controller oracle:communications_converged_application_server_-_service_controller | 6.0; 6.1 | NVD |
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router | 8.0.0; 8.1; 8.2; 8.2.1 | NVD |
oracle communications_element_manager oracle:communications_element_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_online_mediation_controller oracle:communications_online_mediation_controller | 6.1 | NVD |
oracle communications_session_report_manager oracle:communications_session_report_manager | 8.0.0; 8.1.0; 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_session_route_manager oracle:communications_session_route_manager | 8.0.0; 8.1.0; 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management | 7.3; 7.4.0 | NVD |
oracle endeca_information_discovery_integrator oracle:endeca_information_discovery_integrator | 3.2.0 | NVD |
oracle enterprise_manager_for_fusion_applications oracle:enterprise_manager_for_fusion_applications | 13.3.0.0 | NVD |
oracle enterprise_manager_ops_center oracle:enterprise_manager_ops_center | 12.3.3 | NVD |
oracle financial_services_analytical_applications_infrastructure oracle:financial_services_analytical_applications_infrastructure | from 8.0.2 through 8.0.8 | NVD |
oracle flexcube_private_banking oracle:flexcube_private_banking | 12.0.1; 12.0.3; 12.1.0 | NVD |
oracle goldengate_application_adapters oracle:goldengate_application_adapters | 12.3.2.1.0 | NVD |
oracle healthcare_master_person_index oracle:healthcare_master_person_index | 3.0; 4.0.2 | NVD |
oracle identity_manager_connector oracle:identity_manager_connector | 9.0 | NVD |
oracle insurance_calculation_engine oracle:insurance_calculation_engine | 9.7; 10.0; 10.1; 10.2 | NVD |
oracle insurance_policy_administration_j2ee oracle:insurance_policy_administration_j2ee | 10.0; 10.1; 10.2; 10.2.0; 10.2.4; 11.0; 11.1.0; 11.2.0 | NVD |
oracle insurance_rules_palette oracle:insurance_rules_palette | 10.0; 10.1; 10.2; 10.2.0; 10.2.4; 11.0; 11.0.2; 11.1.0; and 1 more ranges | NVD |
oracle mysql_enterprise_monitor oracle:mysql_enterprise_monitor | through 4.0.12; from 8.0.0 through 8.0.20 | NVD |
oracle primavera_analytics oracle:primavera_analytics | 18.8 | NVD |
oracle primavera_gateway oracle:primavera_gateway | 15.2; 16.2; 17.12; 18.8.0 | NVD |
oracle rapid_planning oracle:rapid_planning | 12.1; 12.2 | NVD |
oracle retail_advanced_inventory_planning oracle:retail_advanced_inventory_planning | 15.0 | NVD |
oracle retail_assortment_planning oracle:retail_assortment_planning | 15.0; 16.0 | NVD |
oracle retail_clearance_optimization_engine oracle:retail_clearance_optimization_engine | 14.0.5 | NVD |
oracle retail_financial_integration oracle:retail_financial_integration | 14.0; 14.1; 15.0; 16.0 | NVD |
oracle retail_integration_bus oracle:retail_integration_bus | 15.0; 15.0.3; 16.0; 16.0.3 | NVD |
oracle retail_invoice_matching oracle:retail_invoice_matching | 12.0; 13.0; 13.1; 13.2; 14.0; 14.1 | NVD |
oracle retail_markdown_optimization oracle:retail_markdown_optimization | 13.4.4 | NVD |
oracle retail_order_broker oracle:retail_order_broker | 5.1; 5.2; 15.0; 16.0 | NVD |
oracle retail_predictive_application_server oracle:retail_predictive_application_server | 14.0.3; 14.0.3.26; 14.1.3; 14.1.3.37; 15.0.3; 15.0.3.100; 16.0; 16.0.3 | NVD |
oracle retail_service_backbone oracle:retail_service_backbone | 15.0; 16.0; 16.0.1 | NVD |
oracle retail_xstore_point_of_service oracle:retail_xstore_point_of_service | 7.1 | NVD |
oracle tape_library_acsls oracle:tape_library_acsls | 8.5 | NVD |
oracle webcenter_sites oracle:webcenter_sites | 12.2.1.3.0 | NVD |
oracle weblogic_server oracle:weblogic_server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0 | NVD |
debian debian_linux debian:debian_linux | 9.0 | NVD |
References
- http://www.securityfocus.com/bid/105703vdb-entry, x-refsource-bid, third-party-advisory, url-repurposed
- https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpuapr2020.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlx-refsource-misc, third-party-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpujan2020.htmlx-refsource-misc, patch, third-party-advisory
- https://pivotal.io/security/cve-2018-15756x-refsource-confirm, vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlx-refsource-misc, patch, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2021/04/msg00022.htmlmailing-list, x-refsource-mlist, third-party-advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlx-refsource-misc, not-applicable, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.