CVE-2022-22980: VMware Spring Data MongoDB

Critical severity, CVSS 9.8. EPSS: 17.8% chance of exploitation in the next 30 days.

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

Affected products

• VMware Spring Data MongoDB: up to and including 3.3.4; version 3.4.0 only

Published 2022-06-23. Last modified 2026-06-17.