CVE-2021-22044: VMware Spring Cloud Openfeign

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to `@RequestMapping`-annotated interface methods.

Affected products

• VMware Spring Cloud Openfeign: from 2.2.0, up to and including 2.2.9; from 3.0.0, up to and including 3.0.4

Published 2021-10-28. Last modified 2026-06-17.