Lucene search
GitHub Advisory DatabaseGHSA-558X-2XJG-6232HistoryApr 03, 2022 - 12:01 a.m.
Allocation of Resources Without Limits or Throttling in Spring Framework
2022-04-0300:01:00
CWE-770
GitHub Advisory Database
github.com
32
0.001 Low
EPSS
Percentile
34.6%
In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0.RELEASE - 5.2.19.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.springframework:spring-expression | lt | 5.2.20.RELEASE | |
| org.springframework:spring-expression | lt | 5.3.17 |
References
github.com/advisories/GHSA-558x-2xjg-6232
github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11
github.com/spring-projects/spring-framework/issues/28145
github.com/spring-projects/spring-framework/issues/28257
github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE
github.com/spring-projects/spring-framework/releases/tag/v5.3.17
nvd.nist.gov/vuln/detail/CVE-2022-22950
tanzu.vmware.com/security/cve-2022-22950
Related
spring
spring
CVE report published for Spring Framework
2022-03-28 08:00:00
ibm
ibm
prion
prion
Race condition
2022-04-01 23:15:00
veracode
veracode
Denial Of Service (DoS)
2022-04-07 12:06:55
cvelist
cvelist
CVE-2022-22950
2022-04-01 22:17:32
debiancve
debiancve
CVE-2022-22950
2022-04-01 23:15:00
cve
cve
CVE-2022-22950
2022-04-01 23:15:00
osv
osv
CVE-2022-22950
2022-04-01 23:15:13
Allocation of Resources Without Limits or Throttling in Spring Framework
2022-04-03 00:01:00
nessus
nessus
Spring Framework < 5.2.20 / 5.3.x < 5.3.17 DoS (CVE-2022-22950)
2022-06-08 00:00:00
Dell EMC NetWorker < 19.8 DoS (DSA-2022-350)
2022-12-13 00:00:00
RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.1] (RHSA-2022:5555)
2022-07-15 00:00:00
broadcom
broadcom
openvas
openvas
VMware Spring Framework < 5.2.20, 5.3.x < 5.3.17 DoS Vulnerability - Linux
2022-04-06 00:00:00
VMware Spring Framework < 5.2.20, 5.3.x < 5.3.17 DoS Vulnerability - Windows
2022-04-06 00:00:00
ubuntucve
ubuntucve
CVE-2022-22950
2022-04-01 00:00:00
redhatcve
redhatcve
CVE-2022-22950
2022-03-28 21:07:31
ics
ics
f5
f5
cert
cert
thn
thn
rapid7blog
rapid7blog
Spring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965)
2022-03-30 22:33:54
redhat
redhat
checkpoint_security
checkpoint_security
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00
Oracle Critical Patch Update Advisory - January 2023
2023-01-17 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00