sprig-mvc-demo-patch

This demo application partially covers the vulnerability CVE-2024-38828

The vulnerability CVE-2024-38828 in Spring Framework allows a Denial of Service (DoS) attack by sending a large or specially crafted request to a Spring MVC controller that accepts a parameter of type byte[]. This can cause memory and CPU overload and application crash due to resource exhaustion. In my demo application, I use a custom converter to cover the vulnerability related to uploading large files. To fully cover the vulnerability, it is necessary to set timeouts in the servlet - to protect against slow attacks and optimize the processing of multipart/form-data and raw body requests to avoid excessive memory allocation.

The vulnerability CVE-2024-38828 is fixed in Spring versions above 5.3.33.