CVE-2022-22969: Denial of service in Spring Security OAuth
Summary
CVE-2022-22969: Denial of service in Spring Security OAuth2. Affects org.springframework.security.oauth:spring-security-oauth2 across 2 version ranges.
>= 2.4.0.RELEASE, < 2.4.2.RELEASE
>= 2.5.0.RELEASE, < 2.5.2.RELEASE
Fixed in 2.4.2.RELEASE or 2.5.2.RELEASE, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Security OAuth package is a widely used library for implementing OAuth 2.0 Client applications in Java. It provides functionality for secure authentication and authorization using the OAuth 2.0 protocol. This vulnerability affects versions 2.5.x prior to 2.5.2 and older unsupported versions of the package.
Vulnerability Detail
The vulnerability in Spring Security OAuth allows for a Denial-of-Service (DoS) attack through the initiation of the Authorization Request in an OAuth 2.0 Client application. An attacker can exploit this vulnerability by sending multiple requests to initiate the Authorization Request for the Authorization Code Grant. This can lead to the exhaustion of system resources using a single session. It is important to note that this vulnerability only affects OAuth 2.0 Client applications.
How To Fix
Latest published version: 2.5.2.RELEASE as of 22 Oct 2026
The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.4.0.RELEASE, < 2.4.2.RELEASE2.4.2.RELEASE
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the package as soon as possible.
Conclusion
The vulnerability in Spring Security OAuth can lead to a Denial-of-Service (DoS) attack in OAuth 2.0 Client applications. It is crucial to upgrade to version 2.5.2.RELEASE or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security.oauth:spring-security-oauth2 →
FAQ
Spring Security OAuth is a library for implementing OAuth 2.0 Client applications in Java. It provides functionality for secure authentication and authorization using the OAuth 2.0 protocol.
This vulnerability allows for a Denial-of-Service (DoS) attack in OAuth 2.0 Client applications. An attacker can exhaust system resources using a single session by initiating multiple Authorization Requests for the Authorization Code Grant.
Versions 2.5.x prior to 2.5.2 and older unsupported versions of Spring Security OAuth are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the package.
To update the Spring Security OAuth package, modify the dependency in your project's pom.xml file to version 2.5.2.RELEASE or later. Then rebuild your application.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security.oauth:spring-security-oauth2.
