CVE-2018-1257

6.5 mediumEPSS 3.0%

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

CVSS 3.1: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-25)
Published: 2018-05-11
Modified: 2026-10-08
Record from: the NVD, synced 2026-10-19

Affected

oracle:agile_product_lifecycle_management
oracle:application_testing_suite
oracle:big_data_discovery
oracle:communications_converged_application_server
oracle:communications_diameter_signaling_router
oracle:communications_performance_intelligence_center
oracle:communications_services_gatekeeper
oracle:communications_unified_inventory_management
oracle:endeca_information_discovery_integrator
oracle:enterprise_manager_base_platform
oracle:enterprise_manager_for_mysql_database
oracle:enterprise_manager_ops_center
oracle:flexcube_private_banking
oracle:goldengate_for_big_data
oracle:health_sciences_information_manager
oracle:healthcare_master_person_index
oracle:hospitality_guest_access
oracle:insurance_calculation_engine
oracle:insurance_rules_palette
oracle:primavera_gateway
oracle:retail_customer_insights
oracle:retail_open_commerce_platform
oracle:retail_order_broker
oracle:retail_predictive_application_server
oracle:service_architecture_leveraging_tuxedo
oracle:tape_library_acsls
oracle:utilities_network_management_system
oracle:weblogic_server
redhat:openshift
vmware:spring_framework

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rcpf-vj53-7h2m	Maven	org.springframework:spring-core	>=5.0.0 <5.0.6	5.0.6
GHSA-rcpf-vj53-7h2m	Maven	org.springframework:spring-core	<4.3.17	4.3.17

References

Check your stack JSON