Read the docs
TI-2022-07127 Aliases CVE-2022-22950GHSA-558x-2xjg-6232

Resource allocation without limits in Spring Framework

Priority MEDIUM 61CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.36909 98th percentileScored 2026-11-07
Fix Partial org.springframework:spring-expression (Maven): 5.3.17, 5.2.20.RELEASERed Hat: 4 advisoriesRed Hat: 4 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Spring FrameworkSpring Framework versions 5.3.X prior to 5.3.17+ and all old and unsupported versions—No fix listedCNA
—org.springframework:spring-expression (Maven)5.3.0 to before 5.3.175.3.17Patch availableGHSA-558x-2xjg-6232
—org.springframework:spring-expression (Maven)before 5.2.20.RELEASE5.2.20.RELEASEPatch availableGHSA-558x-2xjg-6232
  • Spring Framework Vendor— Affected Spring Framework versions 5.3.X prior to 5.3.17+ and all old and unsupported versions Fixed in — No fix listed CNA
  • org.springframework:spring-expression (Maven) Vendor— Affected 5.3.0 to before 5.3.17 Fixed in 5.3.17 Patch available GHSA-558x-2xjg-6232
  • org.springframework:spring-expression (Maven) Vendor— Affected before 5.2.20.RELEASE Fixed in 5.2.20.RELEASE Patch available GHSA-558x-2xjg-6232

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*before 5.2.20; 5.3.0 to before 5.3.17VulnerableVMware
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions before 5.2.20; 5.3.0 to before 5.3.17 Vulnerable ·VMware

Remediation

  • Fix · GHSA-558x-2xjg-6232 org.springframework:spring-expression (Maven) Fixed in 5.3.17 Advisory →
  • Fix · GHSA-558x-2xjg-6232 org.springframework:spring-expression (Maven) Fixed in 5.2.20.RELEASE Advisory →

Red Hat 4 advisories

  • RHSA-2022:8761 Released 2022-12-14 · Red Hat rating Moderate
    Red Hat support for Spring Boot 2.7.2 update
    • Text-Only RHOAR
  • RHSA-2022:5903 Released 2022-08-04 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.13.0 security update
    • RHPAM 7.13.0 async
  • RHSA-2022:5555 Released 2022-07-14 · Red Hat rating Moderate
    RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 apache-commons-compress-1.21-1.2.el8ev, apache-commons-compress-javadoc-1.21-1.2.el8ev, ovirt-dependencies-4.5.2-1.el8ev +1
Show 1 more Red Hat advisories
  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 1AffectedNo fix planned: Will not fix
Red Hat Integration Data Virtualisation OperatorAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat support for Spring BootAffectedNo fix yet
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2022:5555
RHPAM 7.13.0 asyncFixed RHSA-2022:5903
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Text-Only RHOARFixed RHSA-2022:8761
Not affected: 9 products
  • A-MQ Clients 2
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat AMQ Broker 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Application Runtimes
  • Red Hat Single Sign-On 7
  • Red Hat build of Quarkus
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22950
  2. 2026-10-03 Alias added: GHSA-558x-2xjg-6232
  3. 2026-10-08 CISA SSVC decision points changed

References

Advisory 2

Other 6

  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
  • TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
  • TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences