CVE-2023-34036 json
Forwarded header exploit with Spring HATEOAS on WebFlux
published 2023-07-17 3 y ago modified 2026-06-17 4 mo ago also GHSA-7m5c-fgwf-mwph , EUVD-2023-1992
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server.
For the application to be affected, it needs to satisfy the following requirements:
* It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
Patch / fix
- maven org.springframework.hateoas:spring-hateoas 1.5.5, 2.0.5, 2.1.1
- vmware spring_hateoas 1.5.5, 2.0.5
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.springframework.hateoas:spring-hateoas | <1.5.5 >=2.0.0, <2.0.5 >=2.1.0, <2.1.1 |
1.5.5 2.0.5 2.1.1 |
Affected products
- Spring Spring HATEOAS
Classification
References
-
spring.io
/security/cve-2023-34036
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-34036
advisory
-
github.com
/spring-projects/spring-hateoas
package
Sources
- CVE List CVE-2023-34036
- GitHub Advisory GHSA-7m5c-fgwf-mwph
- NVD CVE-2023-34036
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.