CVE-2024-38829: Spring LDAP Information Disclosure Flaw

CVE-2024-38829 Overview

CVE-2024-38829 is an information disclosure vulnerability in Spring LDAP caused by locale-dependent case conversion in string comparisons. The framework uses String.toLowerCase() and String.toUpperCase() without specifying a locale, which produces different results in certain locales such as Turkish. Attackers can exploit this behavior to cause queries to return unintended columns, exposing data that should remain restricted. The issue is related to CVE-2024-38820 and is tracked under [CWE-178: Improper Handling of Case Sensitivity].

Critical Impact
Case-insensitive comparisons in Spring LDAP can leak unintended attributes or columns when the JVM default locale changes the outcome of case conversion.

Affected Products

Spring LDAP 2.4.0 through 2.4.3
Spring LDAP 3.0.0 through 3.0.9, 3.1.0 through 3.1.7, 3.2.0 through 3.2.7
All Spring LDAP versions prior to 2.4.0

Discovery Timeline

2024-12-04 - CVE-2024-38829 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38829

Vulnerability Analysis

Spring LDAP performs case-insensitive comparisons on attribute names and query components by normalizing strings with String.toLowerCase() and String.toUpperCase(). When these methods run without an explicit Locale argument, they use the JVM default locale. Certain locales, most notably tr-TR (Turkish), apply non-ASCII case-folding rules. The letter I lowercases to ı rather than i, and i uppercases to İ rather than I.

The divergence breaks the assumption that case-folded attribute identifiers are stable across environments. When Spring LDAP compares a caller-supplied attribute name to an allow-list or projection list, the two sides can normalize differently. This causes attributes that should have been filtered out to match, and queries can return columns or attributes the requester was not authorized to retrieve.

The attack vector is network-based, but exploitation requires high complexity. An attacker needs a Spring LDAP deployment running under an affected locale or the ability to influence locale-sensitive comparisons. Confidentiality impact is limited to disclosure of unintended attributes.

Root Cause

The root cause is the use of locale-default case conversion in security-relevant string comparisons. Fixed builds replace these calls with Locale.ROOT variants, ensuring deterministic ASCII case folding.

Attack Vector

An attacker submits attribute names or filter values crafted to bypass case-insensitive checks that use inconsistent case folding. When the surrounding application runs in a Turkish or similarly affected locale, the mismatched normalization exposes attributes the query was intended to exclude. Refer to the Spring Security Advisory CVE-2024-38829 for full technical details.

Detection Methods for CVE-2024-38829

Indicators of Compromise

LDAP query responses containing attributes outside the expected projection set.
Application logs showing attribute name comparisons that resolve inconsistently between requests.
Unusual LDAP search filters containing the characters I, i, İ, or ı in attribute selectors.

Detection Strategies

Inventory application dependencies for Spring LDAP versions matching the vulnerable ranges.
Static analysis for calls to String.toLowerCase() or String.toUpperCase() without a Locale argument in LDAP-adjacent code paths.
Compare LDAP query results against the expected attribute allow-list and alert on deviations.

Monitoring Recommendations

Log the JVM default locale at application startup and alert on non-ROOT or non-US settings for services performing LDAP operations.
Monitor LDAP audit logs for searches requesting attributes not declared by the application.
Track dependency scanner output for Spring LDAP artifacts flagged against CVE-2024-38829.

How to Mitigate CVE-2024-38829

Immediate Actions Required

Upgrade Spring LDAP to a fixed release: 2.4.4, 3.0.10, 3.1.8, or 3.2.8 or later.
Audit application code for locale-dependent case conversion in attribute handling and replace with Locale.ROOT variants.
Restrict LDAP service account privileges so exposed attributes cannot be used to escalate access.

Patch Information

VMware Spring released patched versions of Spring LDAP that use locale-independent case folding. See the Spring Security Advisory CVE-2024-38829 for the exact fixed versions and change references.

Workarounds

Set the JVM default locale to en-US or invoke the application with -Duser.language=en -Duser.country=US where upgrading is not immediately possible.
Explicitly pass Locale.ROOT to any application-level toLowerCase() or toUpperCase() calls used before LDAP queries.
Enforce server-side LDAP attribute allow-lists at the directory server rather than relying solely on client-side filtering.

bash

# Configuration example: enforce ROOT locale for the JVM running the Spring application
java -Duser.language=en -Duser.country=US -Duser.variant= -jar application.jar