Live › vulnerability › CVE-2022-22965
Go to dashboardSpring MVC and Spring WebFlux applications running on JDK 9 or newer can be exploited through data binding to run code on the server. Attackers can use this flaw against exploited systems as CISA lists it as known exploited, with an EPSS score of 0.996.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware Spring Framework | vendor | – | – |
Unknown from the sources.
Apply updates per vendor instructions; the specific fixed Spring Framework version is unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
This page as .md · .json · in your agent: get_signal("CVE-2022-22965")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.