Spring4Shell: CVE-2022-22965 in Spring Framework
Remote code execution through data binding in Spring MVC and Spring WebFlux on JDK 9 and later.
Published in the NVD on 01/04/2022
CVE-2022-22965
In the CISA catalogue of actively exploited vulnerabilities since 04/04/2022
Exploitation probability (EPSS, 01/11/2026): 99.638 %, percentile 99.950
What is Spring4Shell?
Spring4Shell is a flaw in Spring MVC and Spring WebFlux that allows remote code execution through data binding on JDK 9 and later. The known exploit needs the application to run on Tomcat as a WAR deployment. A Spring Boot application started as an executable jar, the default, is not vulnerable to this exploit, but the flaw is more general and there may be other ways to exploit it.
The NVD rates it at CVSS 9.8, and CISA has listed it as actively exploited since 4 April 2022. In Debian 12 and 13 the package libspring-java is still marked as vulnerable; Debian rates this as unimportant because it supports the package only for building applications.
Affected and fixed versions
Spring Framework 5.3
Affected: 5.3.0 - 5.3.17
Fixed in 5.3.18
Spring Framework
Affected: < 5.2.20
Fixed in 5.2.20
Status in Debian and Ubuntu
Debian 12: libspring-java
Debian 13: libspring-java
The OSV database lists no Ubuntu packages for this flaw.
What to do
Update Spring Framework to 5.3.18 or 5.2.20 or later. Applications usually pull Spring in through their build, so check the version in your dependencies.
Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.
Already have an account? Log in and add Spring Framework
Sources
Facts checked on 02/11/2026 against NVD, CISA KEV, FIRST EPSS, the Debian Security Tracker and OSV.
More known vulnerabilities
- PHP2Shell (CVE-2026-109618, CVE-2026-109619)
- Log4Shell (CVE-2021-44228)
- regreSSHion (CVE-2024-6387)
- XZ Backdoor (CVE-2024-3094)
- Heartbleed (CVE-2014-0160)
- Shellshock (CVE-2014-6271)