redhat support for springboot vulnerabilities

Latest redhat support for springboot CVEs

Newest publication first

1. CVE-2023-6841 Keycloak: amount of attributes per object is not limited and it may lead to dos

   Published 2024-09-10

   High·CVSS 7.5 EPSS 0.74%

   A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.

2. CVE-2023-5379 Undertow: ajp request closes connection exceeding maxrequestsize

   Published 2023-12-12

   High·CVSS 7.5 EPSS 1.0%

   A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens becau...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.