Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Scanner template Public exploit CVE-2022-22965 EUVD-2022-1283GHSA-36p3-wjmg-h94x

Remote Code Execution in Spring Framework

Published Apr 1, 2022 · Updated Oct 21, 2025 · Assigned by vmware

Package: libspring-java Package: libspring-java Package: org.springframework:spring-beans Package: org.springframework:spring-webflux Package: org.springframework:spring-webmvc Package: org.springframework.boot:spring-boot-starter-web Package: org.springframework.boot:spring-boot-starter-webflux Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Affected products

VendorProductAffectedFixed
— Spring Framework Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libspring-java No fix yet —
Debian 13 libspring-java No fix yet —
Debian 12 libspring-java No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 libspring-java 4.3.30-2ubuntu1 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS libspring-java 4.3.30-2ubuntu0.24.04.1~esm1 USN-7165-1
Ubuntu Pro 22.04 LTS libspring-java 4.3.30-1ubuntu0.1~esm1 USN-7165-1
Ubuntu Pro 20.04 LTS libspring-java 4.3.22-4ubuntu0.1~esm1 USN-7165-1
Ubuntu Pro 18.04 LTS libspring-java 4.3.22-1~18.04.1~esm1 USN-7165-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitHub 100 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.springframework:spring-beans < 5.2.20.RELEASE 5.2.20.RELEASE GHSA-36p3-wjmg-h94x
Maven org.springframework:spring-beans >= 5.3.0, < 5.3.18 5.3.18 GHSA-36p3-wjmg-h94x
Maven org.springframework:spring-webflux < 5.2.20.RELEASE 5.2.20.RELEASE GHSA-36p3-wjmg-h94x
Maven org.springframework:spring-webflux >= 5.3.0, < 5.3.18 5.3.18 GHSA-36p3-wjmg-h94x
Maven org.springframework:spring-webmvc < 5.2.20.RELEASE 5.2.20.RELEASE GHSA-36p3-wjmg-h94x
Maven org.springframework:spring-webmvc >= 5.3.0, < 5.3.18 5.3.18 GHSA-36p3-wjmg-h94x
Maven org.springframework.boot:spring-boot-starter-web < 2.5.12 2.5.12 GHSA-36p3-wjmg-h94x
Maven org.springframework.boot:spring-boot-starter-web >= 2.6.0, < 2.6.6 2.6.6 GHSA-36p3-wjmg-h94x
Maven org.springframework.boot:spring-boot-starter-webflux < 2.5.12 2.5.12 GHSA-36p3-wjmg-h94x
Maven org.springframework.boot:spring-boot-starter-webflux >= 2.6.0, < 2.6.6 2.6.6 GHSA-36p3-wjmg-h94x

Advisories 11

References