CVE-2018-15756 — DoS Attack via Range Requests
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
How the score was calculated
- EPSS 9.2% (30-day exploitation probability)+14
- Technical severity (high)+6
- Automatable exploitation (SSVC)+3
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
CISA SSVC assessment CISA
Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Debian Debian Linux, Oracle Agile Product Lifecycle Management, Oracle Communications Brm - Elastic Charging Engine…).
- The attack is network-based and needs no privileges: restrict exposure (ACLs, VPN, WAF) until patched.
- Apply the fixed version or the patch documented under Remediation.
- EPSS ahead of 95% of scored CVEs: prioritize it in the patch queue.
- Search available logs for exploit probes, errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Debian | Debian Linux | version 9.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Agile Product Lifecycle Management | version 9.3.3version 9.3.4version 9.3.5version 9.3.6 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Brm - Elastic Charging Engine | version 11.3version 12.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Converged Application Server - Service Controller | version 6.0version 6.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Diameter Signaling Router | version 8.0.0version 8.1version 8.2version 8.2.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Element Manager | version 8.1.1version 8.2.0version 8.2.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Online Mediation Controller | version 6.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Session Report Manager | version 8.0.0version 8.1.0version 8.1.1version 8.2.0version 8.2.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Session Route Manager | version 8.0.0version 8.1.0version 8.1.1version 8.2.0version 8.2.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Unified Inventory Management | version 7.3version 7.4.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Endeca Information Discovery Integrator | version 3.2.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Enterprise Manager For Fusion Applications | version 13.3.0.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Enterprise Manager Ops Center | version 12.3.3 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Financial Services Analytical Applications Infrastructure | ≥ 8.0.2 and ≤ 8.0.8 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Flexcube Private Banking | version 12.0.1version 12.0.3version 12.1.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Goldengate Application Adapters | version 12.3.2.1.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Healthcare Master Person Index | version 3.0version 4.0.2 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Identity Manager Connector | version 9.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Insurance Calculation Engine | version 9.7version 10.0version 10.1version 10.2 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Insurance Policy Administration J2ee | version 10.0version 10.1version 10.2version 10.2.0version 10.2.4version 11.0version 11.1.0version 11.2.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Insurance Rules Palette |
version 10.0version 10.1version 10.2version 10.2.0version 10.2.4version 11.0version 11.0.2version 11.1.0 and 1 moreversion 11.2.0 |
Vulnerable | NIST National Vulnerability Database |
| Oracle | Mysql Enterprise Monitor | ≤ 4.0.12≥ 8.0.0 and ≤ 8.0.20 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Primavera Analytics | version 18.8 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Primavera Gateway | version 15.2version 16.2version 17.12version 18.8.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Rapid Planning | version 12.1version 12.2 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Advanced Inventory Planning | version 15.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Assortment Planning | version 15.0version 16.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Clearance Optimization Engine | version 14.0.5 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Financial Integration | version 14.0version 14.1version 15.0version 16.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Integration Bus | version 15.0version 15.0.3version 16.0version 16.0.3 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Invoice Matching | version 12.0version 13.0version 13.1version 13.2version 14.0version 14.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Markdown Optimization | version 13.4.4 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Order Broker | version 5.1version 5.2version 15.0version 16.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Predictive Application Server | version 14.0.3version 14.0.3.26version 14.1.3version 14.1.3.37version 15.0.3version 15.0.3.100version 16.0version 16.0.3 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Service Backbone | version 15.0version 16.0version 16.0.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Xstore Point Of Service | version 7.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Tape Library Acsls | version 8.5 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Webcenter Sites | version 12.2.1.3.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Weblogic Server | version 10.3.6.0.0version 12.1.3.0.0version 12.2.1.3.0version 12.2.1.4.0 | Vulnerable | NIST National Vulnerability Database |
| Pivotal | Spring Framework | version 5.1≥ 5.0.0 and ≤ 5.0.9≥ 4.3 and ≤ 4.3.19 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| Vmware | Spring Framework | ≥ 4.2.0 and < 4.3.20≥ 5.0.0 and < 5.0.10version 5.1.0 | Vulnerable | NIST National Vulnerability Database |
Attack characteristics
The CVSS vector, decoded. It describes the attack, not your exposure to it.
Every base score collected
Sources score independently and may disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Scored by |
|---|---|---|---|---|---|
| 7.5 | CVSS 3.1 | High | 3.9 | 3.6 | nvd@nist.gov via NIST National Vulnerability Database |
| 7.5 | CVSS 3.0 | High | 3.9 | 3.6 | security_alert@emc.com via NIST National Vulnerability Database |
| 7.5 | CVSS 3.0 | High | — | — | dell via CVE Program (cve.org) e CISA ADP |
| 5.0 | CVSS 2.0 | Medium | 10.0 | 2.9 | nvd@nist.gov via NIST National Vulnerability Database |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score shown at the top: nvd@nist.gov) EPSS over time FIRST
Oct 13, 2026 → Oct 14, 2026 · 2 reading(s) · max 9.21%
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).
Timeline
What happened to this CVE, newest first.
- 2026
- Affected products added · pivotal/spring framework
- SSVC assessment updated
- Record published
- Fix documented
- CVSS changed · 7.5
- Source status changed · → Modified
- Record created in this database
- 2018
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 1× Official description updated · Oct 13, 2026 – Oct 13, 2026
References
21 on the record
- pivotal.io/security/cve-2018-15756
- www.oracle.com//security-alerts/cpujul2021.html
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- www.oracle.com/security-alerts/cpujul2020.html
- www.oracle.com/security-alerts/cpujan2020.html
- www.oracle.com/security-alerts/cpujan2021.html
- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- www.oracle.com/security-alerts/cpuapr2020.html
- lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%
- lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%
- lists.debian.org/debian-lts-announce/2021/04/msg00022.html
- www.oracle.com/security-alerts/cpuoct2021.html
- www.securityfocus.com/bid/105703
- lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%
- lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%
- lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%
- lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%
- lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%
- lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%
Elsewhere on this site
Related CVEs (same products)
- High CVE-2026-12996 A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote... Jul 30, 2026
- Medium CVE-2026-56968 Use of Uninitialized Resource in Gnu Sasl Jun 23, 2026
- Critical CVE-2026-46859 Improper Authentication in Oracle Agile Product Lifecycle Management Jun 17, 2026
- High CVE-2026-46848 Improper Access Control in Oracle Weblogic Server Jun 17, 2026
- Critical CVE-2026-46809 Improper Access Control in Oracle Webcenter Sites Jun 17, 2026
- Critical CVE-2026-46800 Missing Authentication for Critical Function in Oracle Webcenter Sites Jun 17, 2026
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No CWE classification.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2018-15756 is "DoS Attack via Range Requests", rated High. It affects Debian Linux (Debian); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 7.5 describes technical severity. EPSS 9.21% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.