Read the docs
TI-2021-05097 Aliases CVE-2021-22060GHSA-6gf2-pvqw-37ph

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported…

Priority LOW 22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.

Why it matters now

EPSS 0.00912 60th percentileScored 2026-11-07
Fix Partial org.springframework:spring-core (Maven): 5.3.14, 5.2.19Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Spring FrameworkSpring Framework 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions—No fix listedCNA
—org.springframework:spring-core (Maven)5.3.0 to before 5.3.145.3.14Patch availableGHSA-6gf2-pvqw-37ph
—org.springframework:spring-core (Maven)5.2.0 to before 5.2.195.2.19Patch availableGHSA-6gf2-pvqw-37ph
  • Spring Framework Vendor— Affected Spring Framework 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions Fixed in — No fix listed CNA
  • org.springframework:spring-core (Maven) Vendor— Affected 5.3.0 to before 5.3.14 Fixed in 5.3.14 Patch available GHSA-6gf2-pvqw-37ph
  • org.springframework:spring-core (Maven) Vendor— Affected 5.2.0 to before 5.2.19 Fixed in 5.2.19 Patch available GHSA-6gf2-pvqw-37ph

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*5.2.0 – 5.2.18; 5.3.0 – 5.3.13VulnerableVMware
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions 5.2.0 – 5.2.18; 5.3.0 – 5.3.13 Vulnerable ·VMware
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-6gf2-pvqw-37ph org.springframework:spring-core (Maven) Fixed in 5.3.14 Advisory →
  • Fix · GHSA-6gf2-pvqw-37ph org.springframework:spring-core (Maven) Fixed in 5.2.19 Advisory →

Red Hat 1 advisory

  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Not affected: 3 products
  • Red Hat Decision Manager 7
  • Red Hat Process Automation 7
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22060
  2. 2026-10-03 Alias added: GHSA-6gf2-pvqw-37ph

References

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences