CVE-2018-1257

CVE-2018-1257 is a regular expression denial-of-service (ReDoS) vulnerability affecting Spring Framework versions 5.0.x prior to 5.0.6, 4.3.x prior to 4.3.17, and older unsupported versions. It specifically impacts applications exposing STOMP over WebSocket endpoints with a simple, in-memory STOMP broker via the spring-messaging module, with affected products including Oracle, Red Hat, and VMware. The vulnerability has a CVSS score of 6.5 (Medium), indicating it can be exploited remotely with low attack complexity and no user interaction, leading to a high impact on availability (denial of service). While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 39/100. There is no evidence of active exploitation, nor is exploit code available in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting it is not a high-profile threat.