{"id":"CVE-2018-15756","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-15756","generatedAt":"2026-10-29T00:37:22.086Z","title":"A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack.","description":"Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.","published":"2018-10-18T22:29:00.000Z","lastModified":"2026-10-08T22:16:45.000Z","status":"Modified","sourceIdentifier":"security_alert@emc.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":[],"affected":["vmware/spring framework","oracle/agile product lifecycle management","oracle/communications brm - elastic charging engine","oracle/communications converged application server - service controller","oracle/communications diameter signaling router","oracle/communications element manager","oracle/communications online mediation controller","oracle/communications session report manager","oracle/communications session route manager","oracle/communications unified inventory management","oracle/endeca information discovery integrator","oracle/enterprise manager for fusion applications","oracle/enterprise manager ops center","oracle/financial services analytical applications infrastructure","oracle/flexcube private banking","oracle/goldengate application adapters","oracle/healthcare master person index","oracle/identity manager connector","oracle/insurance calculation engine","oracle/insurance policy administration j2ee","oracle/insurance rules palette","oracle/mysql enterprise monitor","oracle/primavera analytics","oracle/primavera gateway","oracle/rapid planning","oracle/retail advanced inventory planning","oracle/retail assortment planning","oracle/retail clearance optimization engine","oracle/retail financial integration","oracle/retail integration bus","oracle/retail invoice matching","oracle/retail markdown optimization","oracle/retail order broker","oracle/retail predictive application server","oracle/retail service backbone","oracle/retail xstore point of service","oracle/tape library acsls","oracle/webcenter sites","oracle/weblogic server","debian/debian linux"],"epss":{"score":0.09207,"percentile":0.95312,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (9.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/105703","tags":["Third Party Advisory","VDB Entry","URL Repurposed"],"source":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%40%3Cissues.activemq.apache.org%3E","source":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%40%3Cissues.activemq.apache.org%3E","source":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%40%3Cissues.activemq.apache.org%3E","source":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%40%3Cissues.activemq.apache.org%3E","source":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%40%3Cissues.activemq.apache.org%3E","source":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%40%3Cissues.activemq.apache.org%3E","source":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%40%3Cissues.activemq.apache.org%3E","source":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%40%3Cissues.activemq.apache.org%3E","source":"security_alert@emc.com"},{"url":"https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%40%3Cissues.activemq.apache.org%3E","source":"security_alert@emc.com"},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","tags":["Mailing List","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://pivotal.io/security/cve-2018-15756","tags":["Vendor Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Not Applicable","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"http://www.securityfocus.com/bid/105703","tags":["Third Party Advisory","VDB Entry","URL Repurposed"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pivotal.io/security/cve-2018-15756","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Not Applicable","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-15756","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}