CVE-2022-22970: Denial of service in Spring Framework

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-12 · updated 2026-10-08
Weakness: CWE-770

Description

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Affected products

Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Brocade San Navigator: all versions
NetApp Cloud Secure Agent: all versions
OnCommand Insight: all versions
Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
Spring Framework: through 5.2.21; from 5.3.0 through 5.3.19
Maven Org.Springframework:Spring-Beans: before 5.2.22.RELEASE; from 5.3.0 before 5.3.20; 1.0, 1.0-m4, 1.0-rc1, 1.0.1, 1.2, 1.2-rc1 (+213) — fixed in 5.2.22.RELEASE, 5.3.20
Spring Framework: from Spring Framework versions 5.3.x prior through 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versions

How to fix

Upgrade to a fixed version: Maven Org.Springframework:Spring-Beans 5.2.22.RELEASE, 5.3.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22970 or the next vulnerability affects your stack