CVE-2024-22262: Spring Framework URL Parsing with Host Validation
Priority MEDIUM 40CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 1 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01191 68th percentileScored 2026-11-07
Fix Partial Spring Framework (Spring): 6.1.6, 6.0.19, 5.3.34org.springframework:spring-web (Maven): 5.3.34, 6.0.19, 6.1.6Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring Framework | 6.1.x to before 6.1.6; 6.0.x to before 6.0.19; 5.3.x to before 5.3.34 | 6.1.6, 6.0.19, 5.3.34 | Patch available | CNA |
| — | org.springframework:spring-web (Maven) | before 5.3.34 | 5.3.34 | Patch available | GHSA-2wrp-6fg6-hmc5 |
| — | org.springframework:spring-web (Maven) | 6.0.0 to before 6.0.19 | 6.0.19 | Patch available | GHSA-2wrp-6fg6-hmc5 |
| — | org.springframework:spring-web (Maven) | 6.1.0 to before 6.1.6 | 6.1.6 | Patch available | GHSA-2wrp-6fg6-hmc5 |
- Spring Framework VendorVMware Affected 6.1.x to before 6.1.6; 6.0.x to before 6.0.19; 5.3.x to before 5.3.34 Fixed in 6.1.6, 6.0.19, 5.3.34 Patch available CNA
- org.springframework:spring-web (Maven) Vendor— Affected before 5.3.34 Fixed in 5.3.34 Patch available GHSA-2wrp-6fg6-hmc5
- org.springframework:spring-web (Maven) Vendor— Affected 6.0.0 to before 6.0.19 Fixed in 6.0.19 Patch available GHSA-2wrp-6fg6-hmc5
- org.springframework:spring-web (Maven) Vendor— Affected 6.1.0 to before 6.1.6 Fixed in 6.1.6 Patch available GHSA-2wrp-6fg6-hmc5
Remediation
- Fix · CNA Spring Framework (Spring) Fixed in 6.1.6, 6.0.19, 5.3.34
- Fix · GHSA-2wrp-6fg6-hmc5 org.springframework:spring-web (Maven) Fixed in 5.3.34 Advisory →
- Fix · GHSA-2wrp-6fg6-hmc5 org.springframework:spring-web (Maven) Fixed in 6.0.19 Advisory →
- Fix · GHSA-2wrp-6fg6-hmc5 org.springframework:spring-web (Maven) Fixed in 6.1.6 Advisory →
Red Hat 1 advisory
- RHSA-2024:3708 Released 2024-06-06 · Red Hat rating ImportantRed Hat Build of Apache Camel 3.20.6 for Spring Boot security update.
- Red Hat build of Apache Camel 3.20.6 for Spring Boot
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix yet |
| Red Hat build of Apache Camel 3.20.6 for Spring Boot | Fixed | RHSA-2024:3708 |
Not affected: 9 products
- A-MQ Clients 2
- Red Hat AMQ Broker 7
- Red Hat Build of Keycloak
- Red Hat Integration Camel K 1
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of OptaPlanner 8
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2024-22262
- 2026-10-03 Alias added: GHSA-2wrp-6fg6-hmc5
References
Other 5
- https://spring.io/security/cve-2024-22262
- https://security.netapp.com/advisory/ntap-20240524-0003/
- https://github.com/spring-projects/spring-framework
- https://github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java
- https://security.netapp.com/advisory/ntap-20240524-0003
More VMware vulnerabilities
- TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-22262 · CVE Program
- CVE-2024-22262 · NVD
- FIRST EPSS
- GHSA-2wrp-6fg6-hmc5 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-22262 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences