CVE-2022-22965 (Spring4Shell) — Remote Code Execution in...
CRITICAL
Actively Exploited
Remote Code Execution in Spring Framework
Published March 31, 2022Updated October 22, 2025Source: osv
What Should I Do?
Patch Immediately
This vulnerability is confirmed under active exploitation (CISA KEV). Patch within 24-48 hours if possible.
Summary
Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as `Spring4Shell`.
## Impact
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
These are the prerequisites for the exploit:
- JDK 9 or higher
- Apache Tomcat as the Servlet container
- Packaged as WAR
- `spring-webmvc` or `spring-webflux` dependency
## Patches
- Spring Framework [5.3.18](https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18) and [5.2.20](https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE)
- Spring Boot [2.6.6](https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6) and [2.5.12](https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12)
## Workarounds
For those who are unable to upgrade, leaked reports recommend setting `disallowedFields` on `WebDataBinder` through an `@ControllerAdvice`. This works generally, but as a centrally applied workaround fix, may leave some loopholes, in particular if a controller sets `disallowedFields` locally through its own `@InitBinder` method, which overrides the global setting.
To apply the workaround in a more fail-safe way, applications could extend `RequestMappingHandlerAdapter` to update the `WebDataBinder` at the end after all other initialization. In order to do that, a Spring Boot application can declare a `WebMvcRegistrations` bean (Spring MVC) or a `WebFluxRegistrations` bean (Spring WebFlux).
Advisory Timeline
- First published March 31, 2022 (1656 days ago).
- Last revised October 22, 2025 — 1301 days after initial publication.
- Added to CISA's Known Exploited Vulnerabilities catalog 3 days after publication.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update org.springframework.boot:spring-boot-starter-webflux to 2.5.12 or later<!-- Update pom.xml dependency version to 2.5.12 for org.springframework.boot:spring-boot-starter-webflux -->
Maven
Update org.springframework.boot:spring-boot-starter-web to 2.5.12 or later<!-- Update pom.xml dependency version to 2.5.12 for org.springframework.boot:spring-boot-starter-web -->
Maven
Update org.springframework:spring-webmvc to 5.2.20.RELEASE or later<!-- Update pom.xml dependency version to 5.2.20.RELEASE for org.springframework:spring-webmvc -->
Maven
Update org.springframework.boot:spring-boot-starter-webflux to 2.6.6 or later<!-- Update pom.xml dependency version to 2.6.6 for org.springframework.boot:spring-boot-starter-webflux -->
Maven
Update org.springframework:spring-beans to 5.3.18 or later<!-- Update pom.xml dependency version to 5.3.18 for org.springframework:spring-beans -->
Maven
Update org.springframework:spring-webmvc to 5.3.18 or later<!-- Update pom.xml dependency version to 5.3.18 for org.springframework:spring-webmvc -->
Maven
Update org.springframework:spring-beans to 5.2.20.RELEASE or later<!-- Update pom.xml dependency version to 5.2.20.RELEASE for org.springframework:spring-beans -->
Maven
Update org.springframework:spring-webflux to 5.2.20.RELEASE or later<!-- Update pom.xml dependency version to 5.2.20.RELEASE for org.springframework:spring-webflux -->
Maven
Update org.springframework.boot:spring-boot-starter-web to 2.6.6 or later<!-- Update pom.xml dependency version to 2.6.6 for org.springframework.boot:spring-boot-starter-web -->
Maven
Update org.springframework:spring-webflux to 5.3.18 or later<!-- Update pom.xml dependency version to 5.3.18 for org.springframework:spring-webflux -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (10)
Affects 1 ecosystem: maven (5).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.springframework.boot:spring-boot-starter-webflux | maven | 2.0.0.RELEASE, 2.0.1.RELEASE, 2.0.2.RELEASE, 2.0.3.RELEASE (+78 more) | 2.5.12 |
| org.springframework.boot:spring-boot-starter-web | maven | 1.0.0.RELEASE, 1.0.1.RELEASE, 1.0.2.RELEASE, 1.1.0.RELEASE (+143 more) | 2.5.12 |
| org.springframework:spring-webmvc | maven | 1.0, 1.0-rc1, 1.0.1, 1.1 (+200 more) | 5.2.20.RELEASE |
| org.springframework.boot:spring-boot-starter-webflux | maven | 2.6.0, 2.6.1, 2.6.2, 2.6.3 (+2 more) | 2.6.6 |
| org.springframework:spring-beans | maven | 5.3.0, 5.3.1, 5.3.10, 5.3.11 (+14 more) | 5.3.18 |
| org.springframework:spring-webmvc | maven | 5.3.0, 5.3.1, 5.3.10, 5.3.11 (+14 more) | 5.3.18 |
| org.springframework:spring-beans | maven | 1.0, 1.0-m4, 1.0-rc1, 1.0.1 (+193 more) | 5.2.20.RELEASE |
| org.springframework:spring-webflux | maven | 5.0.0.RELEASE, 5.0.1.RELEASE, 5.0.10.RELEASE, 5.0.11.RELEASE (+58 more) | 5.2.20.RELEASE |
| org.springframework.boot:spring-boot-starter-web | maven | 2.6.0, 2.6.1, 2.6.2, 2.6.3 (+2 more) | 2.6.6 |
| org.springframework:spring-webflux | maven | 5.3.0, 5.3.1, 5.3.10, 5.3.11 (+14 more) | 5.3.18 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-74
- CWE-94Code InjectionMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-22965ADVISORY
- https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15WEB
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdfWEB
- https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12WEB
- https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6WEB
- https://github.com/spring-projects/spring-frameworkPACKAGE
- https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASEWEB
- https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18WEB
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005WEB
- https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcementWEB
- https://tanzu.vmware.com/security/cve-2022-22965WEB
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67WEB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965WEB
- https://www.kb.cert.org/vuls/id/970766WEB
- https://www.oracle.com/security-alerts/cpuapr2022.htmlWEB
- https://www.oracle.com/security-alerts/cpujul2022.htmlWEB
- https://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.htmlWEB
- https://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.htmlWEB
Frequently Asked Questions
- What is CVE-2022-22965?
- Remote Code Execution in Spring Framework This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2022-22965?
- CVE-2022-22965 affects org.springframework.boot:spring-boot-starter-webflux, org.springframework.boot:spring-boot-starter-web and org.springframework:spring-webmvc (and 2 more). This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-22965 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Known Exploited Vulnerability
This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
Added to KEV catalog: April 4, 2022
Remediation deadline: April 25, 2022
Also Known As
GHSA-36p3-wjmg-h94x
Related CVEs
- CVE-2023-20860CRITICAL
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch
- CVE-2026-47890CRITICAL
Spring Framework Server Sent Event stream corruption while rendering fragments
- CVE-2026-47884CRITICAL
Spring Framework Improper Path Limitation in XsltView
- CVE-2025-41235HIGH
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
- CVE-2026-47835HIGH
Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
- CVE-2026-41712HIGH
Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
- CVE-2026-41705HIGH
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs
- CVE-2026-41842HIGH
Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies