Critical severity9.8CISA KEVNVD Advisory· Published Apr 1, 2022· Updated Jun 17, 2026

CVE-2022-22965

Description

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.springframework:spring-beansMaven	< 5.2.20.RELEASE	5.2.20.RELEASE
org.springframework:spring-beansMaven	>= 5.3.0, < 5.3.18	5.3.18
org.springframework:spring-webmvcMaven	< 5.2.20.RELEASE	5.2.20.RELEASE
org.springframework:spring-webmvcMaven	>= 5.3.0, < 5.3.18	5.3.18
org.springframework.boot:spring-boot-starter-webMaven	< 2.5.12	2.5.12
org.springframework.boot:spring-boot-starter-webMaven	>= 2.6.0, < 2.6.6	2.6.6
org.springframework:spring-webfluxMaven	< 5.2.20.RELEASE	5.2.20.RELEASE
org.springframework:spring-webfluxMaven	>= 5.3.0, < 5.3.18	5.3.18
org.springframework.boot:spring-boot-starter-webfluxMaven	< 2.5.12	2.5.12
org.springframework.boot:spring-boot-starter-webfluxMaven	>= 2.6.0, < 2.6.6	2.6.6

Affected products

Cisco Systems, Inc./Cx Cloud Agent
cpe:2.3:a:cisco:cx_cloud_agent:*:*:*:*:*:*:*:*
Range: <2.1.0
Oracle Corporation/Commerce Platform
cpe:2.3:a:oracle:commerce_platform:11.3.2:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Automated Test Suite2 versions
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Binding Support Function
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Console2 versions
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Exposure Function
cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Function Cloud Native Environment2 versions
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Repository Function2 versions
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Slice Selection Function3 versions
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.15.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Policy2 versions
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Security Edge Protection Proxy2 versions
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Unified Data Repository2 versions
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Policy Management
cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Unified Inventory Management3 versions
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Analytical Applications Infrastructure2 versions
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Behavior Detection Platform3 versions
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Enterprise Case Management3 versions
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*
Oracle Corporation/Mysql Enterprise Monitor
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
Range: <8.0.29
Oracle Corporation/Product Lifecycle Analytics
cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Bulk Data Integration
cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3:*:*:*:*:*:*:*
Oracle Corporation/Retail Customer Management And Segmentation Foundation3 versions
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Financial Integration4 versions
cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:19.0.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Integration Bus4 versions
cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Merchandising System2 versions
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Xstore Point Of Service2 versions
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:*
Oracle Corporation/Sd Wan Edge2 versions
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*
Oracle Corporation/Weblogic Server3 versions
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
Siemens Foundation/Operation Scheduler
cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*
Range: <2.0.4
Siemens Foundation/Simatic Speech Assistant For Machines
cpe:2.3:a:siemens:simatic_speech_assistant_for_machines:*:*:*:*:*:*:*:*
Range: <1.2.1
Siemens Foundation/Sinec Network Management System
cpe:2.3:a:siemens:sinec_network_management_system:*:*:*:*:*:*:*:*
Range: <1.0.3
Siemens Foundation/Sipass Integrated2 versions
cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*
Siemens Foundation/Siveillance Identity2 versions
cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*
Symantec/Access Appliance3 versions
cpe:2.3:a:veritas:access_appliance:7.4.3.100:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:veritas:access_appliance:7.4.3.100:*:*:*:*:*:*:*
- cpe:2.3:a:veritas:access_appliance:7.4.3.200:*:*:*:*:*:*:*
- cpe:2.3:a:veritas:access_appliance:7.4.3:*:*:*:*:*:*:*
Symantec/Flex Appliance5 versions
cpe:2.3:a:veritas:flex_appliance:1.3:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:veritas:flex_appliance:1.3:*:*:*:*:*:*:*
- cpe:2.3:a:veritas:flex_appliance:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:veritas:flex_appliance:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:veritas:flex_appliance:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:veritas:flex_appliance:2.1:*:*:*:*:*:*:*
Symantec/Netbackup Flex Scale Appliance2 versions
cpe:2.3:a:veritas:netbackup_flex_scale_appliance:2.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:veritas:netbackup_flex_scale_appliance:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:veritas:netbackup_flex_scale_appliance:3.0:*:*:*:*:*:*:*
VMware/Spring Framework
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
Range: <5.2.20
Symantec/NetBackup Appliance7 versions
cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*+ 6 more
- cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_appliance:4.0:*:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_appliance:4.1:*:*:*:*:*:*:*
Symantec/Netbackup Virtual Appliance7 versions
cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*+ 6 more
- cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0:*:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:*
- cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1:*:*:*:*:*:*:*
Spring Projects/Spring MVCcpe-rescue
ghsa-coords5 versions
pkg:maven/org.springframework.boot/spring-boot-starter-web pkg:maven/org.springframework.boot/spring-boot-starter-webflux pkg:maven/org.springframework/spring-beans pkg:maven/org.springframework/spring-webflux pkg:maven/org.springframework/spring-webmvc
< 2.5.12+ 4 more
- (no CPE)range: < 2.5.12
- (no CPE)range: < 2.5.12
- (no CPE)range: < 5.2.20.RELEASE
- (no CPE)range: < 5.2.20.RELEASE
- (no CPE)range: < 5.2.20.RELEASE

Patches

Vulnerability mechanics

References

cert-portal.siemens.com/productcert/pdf/ssa-254054.pdfnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2022.htmlnvdPatchThird Party AdvisoryWEB
packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB EntryWEB
packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.htmlnvdThird Party AdvisoryVDB EntryWEB
github.com/advisories/GHSA-36p3-wjmg-h94xghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-22965ghsaADVISORY
psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005nvdThird Party AdvisoryWEB
tanzu.vmware.com/security/cve-2022-22965nvdMitigationVendor AdvisoryWEB
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67nvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2022.htmlnvdThird Party AdvisoryWEB
github.com/spring-projects/spring-boot/releases/tag/v2.5.12ghsaWEB
github.com/spring-projects/spring-boot/releases/tag/v2.6.6ghsaWEB
github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15ghsaWEB
github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASEghsaWEB
github.com/spring-projects/spring-framework/releases/tag/v5.3.18ghsaWEB
spring.io/blog/2022/03/31/spring-framework-rce-early-announcementghsaWEB
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government ResourceWEB
www.kb.cert.org/vuls/id/970766nvdUS Government ResourceWEB

News mentions

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
Unit 42 · Jul 15, 2026

cvss	0.637
epss	0.080
exploit	0.030
kev	0.120
patch	-0.070
ransomware	0.000