Exploited in the wild · Spring Framework · CVSS 9.8 · published 1 April 2022
Spring4Shell: CVE-2022-22965
A data binding flaw in Spring MVC and WebFlux that can let a remote attacker run code on applications that run on JDK 9 or later and are deployed as a WAR on Tomcat. Below is its status on each Linux distribution past end of life, from the vendors' own security trackers.
- 2end-of-life systems without a free fix
- 7fixed or not affected
Spring4Shell on end-of-life Linux
| Distribution | Status | Details |
|---|---|---|
| CentOS 6 | Not packaged | the distribution does not ship it |
| CentOS 7 | Not packaged | the distribution does not ship it |
| RHEL 7 | Not packaged | the distribution does not ship it |
| CentOS 8 | Not packaged | the distribution does not ship it |
| Ubuntu 16.04 | Not affected | only builds using jdk 9+ are affected |
| Ubuntu 18.04 | Fixed only in Ubuntu Pro | 4.3.22-1~18.04.1~esm1 |
| Ubuntu 20.04 | Fixed only in Ubuntu Pro | 4.3.22-4ubuntu0.1~esm1 |
| Debian 10 | Not packaged | the distribution does not ship it |
| Debian 11 | Not packaged | the distribution does not ship it |
From the Red Hat security data (CentOS and RHEL), the Ubuntu CVE tracker and the Debian security tracker, 29 October 2026. CentOS received Red Hat's fixes only until its own end of life; later fixes went to paid Red Hat support. Fixes marked Ubuntu Pro need a paid subscription. Where a tracker has no entry, the version in the distribution's repository is checked against the NVD range.
The Spring Framework versions we track
| Version | CVE-2022-22965 |
|---|---|
| Spring Framework 4.3.30 | Affected |
| Spring Framework 5.2.25 | Not affected |
| Spring Framework 5.3.39 | Not affected |
For the upstream version, according to the US National Vulnerability Database. A distribution package may carry its own fix; the table above shows that.
What the NVD record says
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Score 9.8 (Critical), published 1 April 2022. Listed in the CISA catalogue of known exploited vulnerabilities on 4 April 2022. Read the NVD entry
Affected upstream versions of Spring Framework
- spring framework before 5.2.20
- spring framework from 5.3.0 before 5.3.18
What you can do
Keep Spring Framework, patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.