PT-2022-15751 · Unknown+1 · Spring Framework+1

Published 2022-05-12 · Updated 2025-11-28 · CVE-2022-22970

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.3.20 Spring Framework versions prior to 5.2.22 Spring Framework old unsupported versions

Description The issue affects applications that handle file uploads and rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object, making them vulnerable to a Denial of Service (DoS) attack.

Recommendations For Spring Framework versions prior to 5.3.20, update to version 5.3.20 or later. For Spring Framework versions prior to 5.2.22, update to version 5.2.22 or later. For Spring Framework old unsupported versions, consider upgrading to a supported version to mitigate the risk of exploitation. As a temporary workaround, consider restricting the use of file uploads or disabling the data binding feature for MultipartFile or javax.servlet.Part until a patch is available.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-22970

GHSA-HH26-6XWR-GGV7

Affected Products

Debian

Spring Framework

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2022-22970 · Security Note
• https://tanzu.vmware.com/security/cve-2022-22970 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-22970 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://osv.dev/vulnerability/GHSA-hh26-6xwr-ggv7 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-22970 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22970 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22970 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-22970 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-22970 · Security Note
• https://github.com/spring-projects/spring-framework · Note
• https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583 · Note
• https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2 · Note
• https://security.netapp.com/advisory/ntap-20220616-0006 · Note
• https://t.me/cvenotify/31013 · Telegram Post