Summary
generated automatically from NVD dataSpring Framework, in versions 5.3.0 through 5.3.16 and older unsupported releases, is affected by a flaw in how it handles SpEL expressions. A user can supply a specially crafted expression that triggers a denial of service, a weakness classed as CWE-770 (allocation of resources without limits or throttling). The issue is rated MEDIUM with a CVSS v3.1 score of 6.5, reachable over the network by a low-privileged user and affecting availability only.
NVD description
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
EPSS · FIRST.org
36.1%probability of exploitation in the next 30 days
Higher than 98% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 1 avr. 2022
- Updated
- 8 oct. 2026
- Status
- Modified
- Source
- security@vmware.com
Affected products
Weaknesses (CWE)
References (2)
- https://tanzu.vmware.com/security/cve-2022-22950MitigationVendor Advisory
- https://tanzu.vmware.com/security/cve-2022-22950MitigationVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-770
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.