TI-2022-07146 Aliases CVE-2022-22969 GHSA-c2cp-3xj9-97w9

Uncontrolled resource consumption in Spring Security OAuth

LOW 31CWE-400Published 2022-04-21 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.

Why it matters now

EPSS 0.01253 69th percentileScored 2026-11-07

Fix Fixed org.springframework.security.oauth:spring-security-oauth2 (Maven): 2.5.2.RELEASE, 2.4.2.RELEASE

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Spring Security OAuth	<affected versions> Spring Security OAuth 2.5.x prior to 2.5.2 and older unsupported versions	—	No fix listed	CNA
—	org.springframework.security.oauth:spring-security-oauth2 (Maven)	2.5.0.RELEASE to before 2.5.2.RELEASE	2.5.2.RELEASE	Patch available	GHSA-c2cp-3xj9-97w9
—	org.springframework.security.oauth:spring-security-oauth2 (Maven)	2.4.0.RELEASE to before 2.4.2.RELEASE	2.4.2.RELEASE	Patch available	GHSA-c2cp-3xj9-97w9

Spring Security OAuth Vendor— Affected <affected versions> Spring Security OAuth 2.5.x prior to 2.5.2 and older unsupported versions Fixed in — No fix listed CNA
org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.5.0.RELEASE to before 2.5.2.RELEASE Fixed in 2.5.2.RELEASE Patch available GHSA-c2cp-3xj9-97w9
org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.4.0.RELEASE to before 2.4.2.RELEASE Fixed in 2.4.2.RELEASE Patch available GHSA-c2cp-3xj9-97w9

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:pivotal:spring_security_oauth::::::::	2.4.0 to before 2.4.2; 2.5.0 to before 2.5.2	Vulnerable	Pivotal
cpe:2.3:a:oracle:communications_design_studio:7.4.2:::::::*	7.4.2	Vulnerable	Oracle

cpe:2.3:a:pivotal:spring_security_oauth:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.4.2; 2.5.0 to before 2.5.2 Vulnerable ·Pivotal
cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Oracle

Remediation

Fix · GHSA-c2cp-3xj9-97w9 org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.5.2.RELEASE Advisory →
Fix · GHSA-c2cp-3xj9-97w9 org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.4.2.RELEASE Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-22969
2026-10-03 Alias added: GHSA-c2cp-3xj9-97w9

References

Patch 1

https://www.oracle.com/security-alerts/cpujul2022.html

Advisory 2

Other 1

https://spring.io/security/cve-2022-22969

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences