GHSA-4gc7-5j7h-4qph: spring-context fixed in 6.1.14, 6.0.24 and 5.3.40

GHSA-4gc7-5j7h-4qph PUBLISHED CVSS 5.300000190734863 MEDIUM

Spring Framework DataBinder Case Sensitive Match Exception

Record from GitHub Advisory Database · Published October 18, 2024

spring-context is fixed in 6.1.14, 6.0.24 and 5.3.40 (Maven Central)

Spring Framework DataBinder Case Sensitive Match Exception

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
org.springframework:spring-context	Maven Central	6.1.14, 6.0.24, 5.3.40
org.springframework:spring-web	Maven Central	6.1.14, 6.0.24, 5.3.40
apache-nifi	Wolfi	2.0.0-r0
apache-nifi	Chainguard	2.0.0-r0
kayenta-fips-2026.0	Chainguard	2026.0.2-r7
thingsboard	Chainguard	3.8.1-r1
jenkins	Chainguard	2.484-r0
thingsboard	Wolfi	3.8.1-r1
jenkins	Wolfi	2.484-r0
kayenta-fips-2025.4	Chainguard	2025.4.3-r7
kayenta-2026.0	Chainguard	2026.0.2-r6
camunda-zeebe	Chainguard	8.6.5-r0

1 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

5.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Vendor	Product	Versions
wolfi	apache-nifi	0
chainguard	apache-nifi	0
chainguard	kayenta-fips-2026.0	0
Maven	org.springframework:spring-context	6.1.0, 0, 6.0.0
chainguard	thingsboard	0
chainguard	jenkins	0
wolfi	thingsboard	0
wolfi	jenkins	0
chainguard	kayenta-fips-2025.4	0
Maven	org.springframework:spring-web	0, 6.1.0, 6.0.0
chainguard	kayenta-2026.0	0
chainguard	camunda-zeebe	0
chainguard	kayenta-2025.4	0

Timeline

Oct 18, 2024 CVE Published
Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-4gc7-5j7h-4qph
vulnetix vdb fixes GHSA-4gc7-5j7h-4qph

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-4gc7-5j7h-4qph/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →