CVE-2022-22965: Remote Code Execution in Spring Framework
Summary
CVE-2022-22965: Remote Code Execution in Spring Framework. Affects org.springframework:spring-beans across 2 version ranges.
< 5.2.20.RELEASE
>= 5.3.0, < 5.3.18
Fixed in 5.2.20.RELEASE or 5.3.18, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2022-22965 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The 'spring-beans' package is a core component of the Spring Framework, responsible for managing and configuring beans. The 'spring-webmvc' and 'spring-webflux' packages are modules that provide web application development support. These packages are commonly used in Spring MVC and Spring WebFlux applications. However, versions prior to 5.2.20 and 5.3.18 of the Spring Framework are vulnerable to remote code execution.
Vulnerability Detail
The vulnerability, known as 'Spring4Shell', allows for remote code execution in Spring MVC or Spring WebFlux applications running on JDK 9 or higher. The exploit requires the application to be deployed on Apache Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, it is not vulnerable. However, there may be other ways to exploit the vulnerability. The specific exploit takes advantage of data binding and can lead to remote code execution. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 7.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.2.20.RELEASE5.2.20.RELEASE -
>= 5.3.0, < 5.3.185.3.18
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For those unable to immediately upgrade, a workaround is suggested. It involves setting 'disallowedFields' on 'WebDataBinder' through an '@ControllerAdvice'. However, this workaround may have some loopholes if a controller sets 'disallowedFields' locally through its own '@InitBinder' method, overriding the global setting. To apply the workaround in a more fail-safe way, applications can extend 'RequestMappingHandlerAdapter' to update the 'WebDataBinder' at the end after all other initialization. This can be achieved by declaring a 'WebMvcRegistrations' bean for Spring MVC or a 'WebFluxRegistrations' bean for Spring WebFlux.
Conclusion
The 'Spring4Shell' remote code execution vulnerability in the Spring Framework poses a significant risk to applications running on JDK 9 or higher with Apache Tomcat as the Servlet container. It is crucial to upgrade to the latest patched versions of the Spring Framework and Spring Boot to mitigate this vulnerability. If immediate upgrade is not possible, applying the suggested workaround can provide some level of protection. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-beans →
FAQ
The vulnerability allows for remote code execution in Spring MVC or Spring WebFlux applications running on JDK 9 or higher. An attacker could potentially execute arbitrary code on the server, leading to a complete compromise of the application and its underlying system.
The prerequisites for exploiting this vulnerability are JDK 9 or higher, Apache Tomcat as the Servlet container, packaging the application as a WAR, and having the 'spring-webmvc' or 'spring-webflux' dependency.
No, Spring Boot executable jar deployment is not vulnerable to this specific exploit. However, it is still recommended to upgrade to the latest patched versions to ensure overall security.
Yes, a workaround is available by setting 'disallowedFields' on 'WebDataBinder' through an '@ControllerAdvice'. However, this workaround may have some limitations and is not as secure as upgrading to the patched versions.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-beans.
