CVE-2023-34053

What it actually does

Specially crafted HTTP requests trigger excessive resource consumption leading to denial-of-service when Spring MVC or WebFlux is paired with micrometer-core and an active ObservationRegistry.

Why it matters to the business

Public-facing applications can be rendered unavailable by unauthenticated remote attackers, causing service outages and operational disruption; the issue is widespread in Spring Boot actuator-enabled deployments but carries low observed exploitation rates more than two years after disclosure.

How an attack unfolds

An attacker identifies a reachable endpoint in an application using Spring MVC/WebFlux with Micrometer observations enabled, then sends a sequence of malformed HTTP requests that cause unbounded observation recording and eventual resource exhaustion.

How to fix it

Upgrade Spring Framework to the fixed commit 28bb639736c98213bcc5f34a33aa0e093690fcc8 or later; alternatively disable micrometer observations or remove the spring-boot-actuator dependency if observation recording is not required.

How to confirm the fix worked

Verify the Spring Framework version in the deployed artifact, confirm the ObservationRegistry bean is absent or that the application no longer accepts the previously triggering request patterns under load testing.

Typical attack path

1. Discover publicly accessible Spring-based web endpoints
2. Confirm presence of micrometer-core and ObservationRegistry via actuator or error responses
3. Transmit crafted HTTP requests designed to trigger excessive observation handling
4. Sustain the request pattern until the application becomes unresponsive

How to detect it

Review web server and application logs for high volumes of requests with unusual headers or malformed paths that coincide with spikes in CPU or memory usage; correlate with actuator endpoint access patterns if enabled.

What your security team should do

• Prioritize upgrade of all internet-facing Spring Boot applications that include the actuator and micrometer dependencies
• Add dependency version constraints in build pipelines to enforce the patched Spring Framework release
• Monitor EPSS and threat intelligence feeds for any future increase in exploitation activity despite current low scores