CVE-2022-22950: VMware Spring Framework

Medium severity, CVSS 6.5. EPSS: 36.1% chance of exploitation in the next 30 days.

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

Affected products

• VMware Spring Framework: before 5.2.20 (fixed in 5.2.20); from 5.3.0, before 5.3.17 (fixed in 5.3.17)

Published 2022-04-01. Last modified 2026-10-08.