VMware Tanzu Spring Framework: Mehrere Schwachstellen ermöglichen Denial of Service

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2022-22970 Public exploit

  Denial of service in Spring Framework

  In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

  libspring-java libspring-java jenkins org.springframework:spring-beans Debian Ubuntu Alpine Maven
  May 12, 2022
• Medium 6.5
  CVE-2022-22971 Public exploit

  Allocation of Resources Without Limits or Throttling in Spring Framework

  In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

  libspring-java libspring-java jenkins org.springframework:spring-messaging Debian Ubuntu Alpine Maven
  May 12, 2022

Revision history

1. 2026-10-25 #6

   Neue Updates von IBM aufgenommen

2. 2024-03-20 #5

   Neue Updates von IBM aufgenommen

3. 2022-09-15 #4

   Neue Updates aufgenommen

4. 2022-06-16 #3

   Neue Updates von NetApp aufgenommen

5. 2022-05-17 #2

   Referenz(en) aufgenommen: 2087274, 2087272

6. 2022-05-10 #1

   Initiale Fassung

References

• NetApp Security Advisory NTAP-20220616-0006 vom 2022-06-16
  https://security.netapp.com/advisory/ntap-20220616-0006/
• Spring Blog vom 2022-05-10
  https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now
• JFrog Fixed Security Vulnerabilities vom 2022-09-15
  https://www.jfrog.com/confluence/display/JFROG/Fixed+Security+Vulnerabilities
• IBM Security Bulletin 7144861 vom 2024-03-20
  https://www.ibm.com/support/pages/node/7144861
• IBM Security Bulletin 7293838 vom 2026-10-23
  https://www.ibm.com/support/pages/node/7293838