GHSA-558x-2xjg-6232MediumCVSS 6.5

Allocation of Resources Without Limits or Throttling in Spring Framework

Published
April 3, 2022
Last Modified
March 28, 2023

🔗 CVE IDs covered (1)

CVE-2022-22950 →

📋 Description

In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0.RELEASE - 5.2.19.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

🎯 Affected products2

  • maven/org.springframework:spring-expression:>= 5.3.0, < 5.3.17
  • maven/org.springframework:spring-expression:< 5.2.20.RELEASE

🔗 References (8)