CVE-2022-22969: Oracle Communications Design Studio

Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days.

<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.

Affected products

• Oracle Communications Design Studio: version 7.4.2 only
• Pivotal Spring Security OAuth: from 2.4.0, before 2.4.2 (fixed in 2.4.2); from 2.5.0, before 2.5.2 (fixed in 2.5.2)

Published 2022-04-21. Last modified 2026-06-17.