What’s Vulnerable › Vulnerabilities

CVE-2024-38807: CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-23 · updated 2026-06-17
• Weakness: CWE-290

Description

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

Affected products

• Spring Boot: from 2.7.x before 2.7.22; from 3.0.x before 3.0.17; from 3.1.x before 3.1.13; from 3.2.x before 3.2.9; from 3.3.x before 3.3.3 — fixed in 2.7.22, 3.0.17, 3.1.13, 3.2.9, 3.3.3

How to fix

Upgrade to a fixed version: Spring Boot 2.7.22, 3.0.17, 3.1.13, 3.2.9. Check the vendor advisory for mitigations.

References

• https://spring.io/security/cve-2024-38807
• https://security.netapp.com/advisory/ntap-20250117-0006/

Get alerted when CVE-2024-38807 or the next vulnerability affects your stack