What’s Vulnerable › Vulnerabilities
CVE-2022-22950
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 36.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-04-01 · updated 2026-10-08
- Weakness: CWE-770
Description
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
Affected products
- Spring Framework: before 5.2.20; from 5.3.0 before 5.3.17 — fixed in 5.2.20, 5.3.17
- Spring Framework: from Spring Framework versions 5.3.X prior through 5.3.17+ and all old and unsupported versions
How to fix
Upgrade to a fixed version: Spring Framework 5.2.20, 5.3.17. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2022-22950 or the next vulnerability affects your stack