Skip to content
OpenAdvisories

Package · Maven

org.springframework:spring-context

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low 3.1
    CVE-2025-22233

    Spring Framework DataBinder Case Sensitive Match Exception

    CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Produ…

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • Low 3.1
    CVE-2024-38820 Public exploit

    CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

    The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

    VMware Spring libspring-java libspring-java Debian Ubuntu Maven
  • High 7.5
    CVE-2022-22968 Public exploit

    Improper handling of case sensitivity in Spring Framework

    In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower ca…

    libspring-java libspring-java org.springframework:spring-context Debian Ubuntu Maven