Allocation of Resources Without Limits or Throttling SNYK-JAVA-ORGSPRINGFRAMEWORK-7687446

[github-actions]

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Note: An application is vulnerable when the following is true:

The application evaluates user-supplied SpEL expressions.

Workaround

Evaluation of user-supplied SpEL expressions should be avoided when possible; otherwise, user-supplied SpEL expressions should be evaluated with a SimpleEvaluationContext in read-only mode. No other steps are necessary.

Remediation

Upgrade org.springframework:spring-expression to version 5.3.39 or higher.

References

• GitHub Commit
• GitHub Commit
• Spring Security Advisory