CVE-2022-22950: Allocation of Resources Without Limits or Throttling in Spring Framework
Summary
CVE-2022-22950: Allocation of Resources Without Limits or Throttling in Spring Framework. Affects org.springframework:spring-expression across 2 version ranges.
< 5.2.20.RELEASE
>= 5.3.0, < 5.3.17
Fixed in 5.2.20.RELEASE or 5.3.17, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2022-22950 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The 'org.springframework:spring-expression' package is a part of the Spring Framework and is used for evaluating Spring Expression Language (SpEL) expressions. SpEL is a powerful expression language that allows dynamic evaluation of expressions at runtime. It is commonly used in Spring applications for tasks such as data binding, validation, and dynamic query generation. However, a vulnerability has been discovered in versions 5.3.0 - 5.3.16, 5.2.0.RELEASE - 5.2.19.RELEASE, and older unsupported versions of the Spring Framework, which could lead to a denial of service (DoS) condition.
Vulnerability Detail
The vulnerability (CVE-2022-22950) arises from a flaw in the Spring Framework's handling of SpEL expressions. An attacker can exploit this vulnerability by providing a specially crafted SpEL expression that triggers excessive resource allocation, leading to a DoS condition. This can result in the unavailability of the affected Spring application, impacting its functionality and potentially affecting other dependent systems. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.2.20.RELEASE5.2.20.RELEASE -
>= 5.3.0, < 5.3.175.3.17
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, it is recommended to follow best practices for secure coding and input validation to minimize the risk of exploitation.
Conclusion
The vulnerability (CVE-2022-22950) in the Spring Framework's handling of SpEL expressions can lead to a denial of service condition. It is recommended to upgrade to the fixed versions mentioned in the 'how_to_fix' section or take appropriate mitigation measures. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-expression →
FAQ
This vulnerability can lead to a denial of service (DoS) condition, causing the affected Spring application to become unavailable and potentially impacting other dependent systems.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
Yes, a fix is available for this vulnerability. It is recommended to upgrade to a fixed version of the Spring Framework as mentioned in the 'how_to_fix' section.
Unsupported versions should be upgraded to a supported version to receive the fix. If upgrading is not feasible, implementing additional security measures such as network segmentation and access controls can help mitigate the risk.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to the advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-expression.
