Fixing Spring Boot Startup Errors After CVE‑2023‑34035 Upgrade

Problem description: After upgrading Spring Boot to address CVE‑2023‑34034 and CVE‑2023‑34035, the application fails to start with an error.

This method cannot decide whether these patterns are Spring MVC patterns or not.
If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher);
otherwise, please use requestMatchers(AntPathRequestMatcher).

Root Cause

Spring Security versions prior to 5.8.5, 6.0.5, and 6.1.2 are vulnerable when an application uses requestMatchers(String) together with multiple servlets, one of which is the Spring MVC DispatcherServlet. The vulnerability (CVE‑2023‑34035) allows misconfiguration of authorization rules.

The issue occurs when all of the following are true:

The classpath contains Spring MVC.

Spring Security protects multiple servlets, including the DispatcherServlet.

The application references non‑Spring MVC endpoints with requestMatchers(String).

The application is not affected if any of these conditions are false:

Spring MVC is absent from the classpath.

Only servlets other than the DispatcherServlet are secured.

Only Spring MVC endpoints use requestMatchers(String).

Affected Spring Security Versions

5.8.0 – 5.8.4

6.0.0 – 6.0.4

6.1.0 – 6.1.1

Mitigation

Users of the affected versions should upgrade:

5.8.x → 5.8.5 (Spring Boot 2.7.14)

6.0.x → 6.0.5 (Spring Boot 3.0.9)

6.1.x → 6.1.2 (Spring Boot 3.1.2)

If multiple servlets are used and one is the Spring MVC DispatcherServlet, the startup may show the following message:

This method cannot decide whether these patterns are Spring MVC patterns or not.
If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher);
otherwise, please use requestMatchers(AntPathRequestMatcher).

Follow the guidance in the error message. For example, replace requestMatchers(String) that points to a non‑Spring MVC endpoint with requestMatchers(new AntPathRequestMatcher("/endpoint")).

References

https://spring.io/security/cve-2023-34035