Package
data-prepper
Component
spring-web
Latest update
3.1
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
CVE-2024-38820 is fixed in Spring Framework 6.1.14 (https://spring.io/security/cve-2024-38820). The fix for the 5.3 line, 5.3.41, is available only through commercial support, and the last public 5.3 release, 5.3.39, which this package ships, is still affected. Data Prepper, including its 2.16.0 release and its development branch, uses Spring Framework 5.3.39 with a Java 11 toolchain, while Spring Framework 6 requires Java 17, so moving to a fixed Spring needs an upstream Data Prepper change. Waiting for the first upstream release containing the fix.
Status