In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported…
Priority LOW 23CWE-117Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 4 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.
Why it matters now
EPSS 0.01352 71st percentileScored 2026-11-07
Fix Partial org.springframework:spring-core (Maven): 5.3.11, 5.2.18org.springframework:spring (Maven): 5.2.18, 5.3.11Red Hat: 5 advisoriesRed Hat: 4 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Spring Framework | Spring Framework versions 5.3.x prior to 5.3.12+, 5.2.x prior to 5.2.18+ and all older unsupported versions are impacted. | — | No fix listed | CNA |
| — | org.springframework:spring-core (Maven) | 5.3.0 to before 5.3.11 | 5.3.11 | Patch available | GHSA-rfmp-97jj-h8m6 |
| — | org.springframework:spring-core (Maven) | 5.2.0 to before 5.2.18 | 5.2.18 | Patch available | GHSA-rfmp-97jj-h8m6 |
| — | org.springframework:spring (Maven) | 5.2.0 to before 5.2.18 | 5.2.18 | Patch available | GHSA-rfmp-97jj-h8m6 |
| — | org.springframework:spring (Maven) | 5.3.0 to before 5.3.11 | 5.3.11 | Patch available | GHSA-rfmp-97jj-h8m6 |
- Spring Framework Vendor— Affected Spring Framework versions 5.3.x prior to 5.3.12+, 5.2.x prior to 5.2.18+ and all older unsupported versions are impacted. Fixed in — No fix listed CNA
- org.springframework:spring-core (Maven) Vendor— Affected 5.3.0 to before 5.3.11 Fixed in 5.3.11 Patch available GHSA-rfmp-97jj-h8m6
- org.springframework:spring-core (Maven) Vendor— Affected 5.2.0 to before 5.2.18 Fixed in 5.2.18 Patch available GHSA-rfmp-97jj-h8m6
- org.springframework:spring (Maven) Vendor— Affected 5.2.0 to before 5.2.18 Fixed in 5.2.18 Patch available GHSA-rfmp-97jj-h8m6
- org.springframework:spring (Maven) Vendor— Affected 5.3.0 to before 5.3.11 Fixed in 5.3.11 Patch available GHSA-rfmp-97jj-h8m6
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | 5.2.0 – 5.2.17; 5.3.0 – 5.3.10 | Vulnerable | VMware |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:metrocluster_tiebreaker:-:*:*:*:*:clustered_data_ontap:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:* | 1.15.0 | Vulnerable | Oracle |
- cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions 5.2.0 – 5.2.17; 5.3.0 – 5.3.10 Vulnerable ·VMware
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:metrocluster_tiebreaker:-:*:*:*:*:clustered_data_ontap:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-rfmp-97jj-h8m6 org.springframework:spring-core (Maven) Fixed in 5.3.11 Advisory →
- Fix · GHSA-rfmp-97jj-h8m6 org.springframework:spring-core (Maven) Fixed in 5.2.18 Advisory →
- Fix · GHSA-rfmp-97jj-h8m6 org.springframework:spring (Maven) Fixed in 5.2.18 Advisory →
- Fix · GHSA-rfmp-97jj-h8m6 org.springframework:spring (Maven) Fixed in 5.3.11 Advisory →
Red Hat 5 advisories
- RHSA-2022:6393 Released 2022-09-08 · Red Hat rating ImportantRHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.5.2.4-0.1.el8ev, ovirt-engine-backend-4.5.2.4-0.1.el8ev, ovirt-engine-dbscripts-4.5.2.4-0.1.el8ev +20
- RHSA-2022:5555 Released 2022-07-14 · Red Hat rating ModerateRHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 apache-commons-compress-1.21-1.2.el8ev, apache-commons-compress-javadoc-1.21-1.2.el8ev, ovirt-dependencies-4.5.2-1.el8ev +1
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
Show 2 more Red Hat advisories
- RHSA-2022:1110 Released 2022-03-29 · Red Hat rating ModerateRed Hat Decision Manager 7.12.1 security update
- RHDM 7.12.1
- RHSA-2022:1108 Released 2022-03-29 · Red Hat rating ModerateRed Hat Process Automation Manager 7.12.1 security update
- RHPAM 7.12.1
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| RHDM 7.12.1 | Fixed | RHSA-2022:1110 |
| RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 | Fixed | RHSA-2022:5555, RHSA-2022:6393 |
| RHPAM 7.12.1 | Fixed | RHSA-2022:1108 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
Not affected: 1 product
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-22096
- 2026-10-03 Alias added: GHSA-rfmp-97jj-h8m6
References
Advisory 4
Sources
- CVE-2021-22096 · CVE Program
- CVE-2021-22096 · NVD
- FIRST EPSS
- GHSA-rfmp-97jj-h8m6 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-22096 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences