Spring Boot Welcome Page Denial of Service
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Specifically, an application is vulnerable if all of the conditions are true:
- The application has Spring MVC auto-configuration enabled. This is the case by default if Spring MVC is on the classpath.
- The application makes use of Spring Boot's welcome page support, either static or templated.
- Your application is deployed behind a proxy which caches 404 responses.
Your application is NOT vulnerable if any of the following are true:
- Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfiguration is explicitly excluded, if Spring MVC is not on the classpath, or if spring.main.web-application-type is set to a value other than SERVLET.
- The application does not use Spring Boot's welcome page support.
- You do not have a proxy which caches 404 responses.
Affected Spring Products and Versions
Spring Boot
3.0.0 to 3.0.6 2.7.0 to 2.7.11 2.6.0 to 2.6.14 2.5.0 to 2.5.14
Older, unsupported versions are also affected Mitigation
Users of affected versions should apply the following mitigations:
- 3.0.x users should upgrade to 3.0.7+
- 2.7.x users should upgrade to 2.7.12+
- 2.6.x users should upgrade to 2.6.15+
- 2.5.x users should upgrade to 2.5.15+
Users of older, unsupported versions should upgrade to 3.0.7+ or 2.7.12+.
Workarounds: configure the reverse proxy not to cache 404 responses and/or not to cache responses to requests to the root (/) of the application.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.springframework.boot:spring-boot-autoconfigure | >= 3.0.0, < 3.0.7, >= 2.7.0, < 2.7.12, >= 2.6.0, < 2.6.15, < 2.5.15 | 3.0.7, 2.7.12, 2.6.15, 2.5.15 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-20883
- https://github.com/spring-projects/spring-boot/issues/35552
- https://github.com/spring-projects/spring-boot/commit/418dd1ba5bdad79b55a043000164bfcbda2acd78
- https://github.com/spring-projects/spring-boot
- https://github.com/spring-projects/spring-boot/releases/tag/v2.5.15
- https://github.com/spring-projects/spring-boot/releases/tag/v2.6.15
- https://github.com/spring-projects/spring-boot/releases/tag/v2.7.12
- https://security.netapp.com/advisory/ntap-20230703-0008
- https://spring.io/security/cve-2023-20883
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-400- Platform
- Java / Kotlin (Maven)
- Package
org.springframework.boot:spring-boot-autoconfigure- Disclosed
- 26.05.2023
- Updated
- 11.10.2026 12:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-xf96-w227-r7c4 - CC BY 4.0
Vulnerability history: org.springframework.boot:spring-boot-autoconfigure
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 05.2023 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 1
Disclosures per year
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 1
-
Spring Boot Welcome Page Denial of Service this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.