CVE-2018-15756

CVE-2018-15756 is a denial-of-service vulnerability affecting Spring Framework versions 5.1, 5.0.x prior to 5.0.10, 4.3.x prior to 4.3.20, and older unsupported 4.2.x branches. It allows a malicious actor to craft range requests with a high number of ranges or wide, overlapping ranges when static resources are served, leading to a denial of service. This impacts applications using spring-webmvc or spring-webflux that serve static resources or return org.springframework.core.io.Resource from annotated controllers, including Spring Boot applications with spring-boot-starter-web or spring-boot-starter-webflux. The vulnerability has a CVSS v3.1 score of 7.5 (HIGH), indicating a network-based attack with low complexity and no privileges or user interaction required, resulting in high availability impact. Its EPSS score is 0.10307, suggesting a relatively low probability of exploitation compared to other CVEs. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, with zero mentions or articles, which is typical for a large percentage of CVEs.