GitHub Advisoryadvisory · Maven

GHSA-558x-2xjg-6232 Allocation of Resources Without Limits or Throttling in Spring Framework

MEDIUM Published 2022-04-03 Modified 2023-03-28 Official page ↗
Aliases
CVE-2022-22950
Ecosystem
Maven
Packages
org.springframework:spring-expression
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2022-04-05

Affected packages

• Maven org.springframework:spring-expression: >= 5.3.0, < 5.3.17 → fixed in 5.3.17 • Maven org.springframework:spring-expression: < 5.2.20.RELEASE → fixed in 5.2.20.RELEASE

Description

In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0.RELEASE - 5.2.19.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

Related

Alias · CVE (1)

  • CVE-2022-22950 n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References