Integer overflow in Spring Security
Priority LOW 29CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 fixed, 11 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
Why it matters now
EPSS 0.02344 83rd percentileScored 2026-11-07
Fix Partial org.springframework.security:spring-security-core (Maven): 5.5.7, 5.6.4Red Hat: 2 advisoriesRed Hat: 2 fixed, 11 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Spring Security | Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions | — | No fix listed | CNA |
| — | org.springframework.security:spring-security-core (Maven) | 5.2.0.RELEASE to before 5.5.7 | 5.5.7 | Patch available | GHSA-wx54-3278-m5g4 |
| — | org.springframework.security:spring-security-core (Maven) | 5.6.0 to before 5.6.4 | 5.6.4 | Patch available | GHSA-wx54-3278-m5g4 |
- Spring Security Vendor— Affected Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions Fixed in — No fix listed CNA
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.2.0.RELEASE to before 5.5.7 Fixed in 5.5.7 Patch available GHSA-wx54-3278-m5g4
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.6.0 to before 5.6.4 Fixed in 5.6.4 Patch available GHSA-wx54-3278-m5g4
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* | 5.2.1 to before 5.5.7; 5.6.0 to before 5.6.4 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_security:5.2.0:-:*:*:*:*:*:* | 5.2.0 | Vulnerable | VMware |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* | 8.0.8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* | 8.0.8.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions 5.2.1 to before 5.5.7; 5.6.0 to before 5.6.4 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_security:5.2.0:-:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·VMware
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-wx54-3278-m5g4 org.springframework.security:spring-security-core (Maven) Fixed in 5.5.7 Advisory →
- Fix · GHSA-wx54-3278-m5g4 org.springframework.security:spring-security-core (Maven) Fixed in 5.6.4 Advisory →
Red Hat 2 advisories
- RHSA-2023:3663 Released 2023-06-19 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1686831822-1.el8, jenkins-2.401.1.1686831596-3.el8
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Data Virtualisation Operator | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 | Fixed | RHSA-2023:3663 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
Not affected: 12 products
- A-MQ Clients 2
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
- Red Hat Data Grid 8
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 1
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Container Platform 4
- Red Hat Single Sign-On 7
- Red Hat build of Quarkus
- Red Hat support for Spring Boot
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22976
- 2026-10-03 Alias added: GHSA-wx54-3278-m5g4
References
Advisory 3
Other 4
- https://github.com/spring-projects/spring-security/commit/388a7b62b906bd56deadb7ca45248fa1a63bdf12
- https://github.com/spring-projects/spring-security/commit/a40f73521c0dd88b879ff6165d280e78bdf8154f
- https://github.com/spring-projects/spring-security
- https://security.netapp.com/advisory/ntap-20220707-0003
Sources
- CVE-2022-22976 · CVE Program
- CVE-2022-22976 · NVD
- FIRST EPSS
- GHSA-wx54-3278-m5g4 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-22976 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences